VULNERABILITY INTELLIGENCE

CVE-2021-41802

CVSS score2.9 LOW
EPSS probability0.61%
CISA KEVNot currently listed
Published2021-10-08
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N

Description

HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4.

Weakness classification

  • CWE-732: Incorrect Permission Assignment for Critical Resource

Primary references