VULNERABILITY INTELLIGENCE

CVE-2020-16251

CVSS score8.2 HIGH

EPSS probability2.83%

CISA KEVNot currently listed

Published2020-08-26

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Description

HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.

Weakness classification

nvd@nist.gov: CWE-287

Primary references

cve@mitre.org — Third Party Advisory, VDB Entry
cve@mitre.org — Release Notes, Third Party Advisory
cve@mitre.org — Product, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Product, Vendor Advisory