Vault Community Edition privilege escalation vulnerability

CAO 7.2CVE-2024-9180 · BIT-openbao-2024-9180 · BIT-vault-2024-9180 · Công bố 10/10/2024 · cập nhật 17/06/2026

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/hashicorp/vault Go	`< 1.18.0`	`1.18.0`
github.com/openbao/openbao Go	`< 2.0.3`	`2.0.3`
vault hashicorp	`≥ 1.15.0, < 1.15.16≥ 1.16.0, < 1.16.11≥ 1.7.7, ≤ 1.17.7≥ 1.7.7, < 1.18.0`	`1.15.161.16.111.18.0`
openbao openbao	`< 2.0.3`	`2.0.3`

Mô tả

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16

Mô tả của NVD

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16.