VULNERABILITY INTELLIGENCE

CVE-2020-16250

CVSS score8.2 HIGH

EPSS probability1.51%

CISA KEVNot currently listed

Published2020-08-26

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Description

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..

Weakness classification

nvd@nist.gov: CWE-290

Primary references

cve@mitre.org — Third Party Advisory, VDB Entry
cve@mitre.org — Release Notes, Vendor Advisory
cve@mitre.org — Product, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Product, Vendor Advisory