Description (CNA)
If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| HashiCorp / Vault | affected 0.11.2 before 2.0.0 |
| HashiCorp / Vault Enterprise | affected 0.11.2 before 2.0.0 |
CWE
CWE-201
References
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in Vault. When a Vault authentication mount is configured to pass through the "Authorization" header, and this header is used for authentication, Vault incorrectly forwards the sensitive Vault token to the authentication plugin backend. This can lead to the disclosure of authentication tokens to potentially untrusted or compromised backend plugins, enabling unauthorized access or further system compromise.