Security researchers have uncovered a series of critical vulnerabilities in HashiCorp Vault and CyberArk Conjur, two widely used open-source secrets management systems. These discoveries, totaling 14 vulnerabilities, include serious exploits such as authentication bypasses, multi-factor authentication (MFA) evasion, privilege escalation, and remote code execution (RCE) attack chains.
The vulnerabilities emerged from logical errors within the core authentication flows and policy enforcement mechanisms of these systems. Specifically, the issues impacted multiple authentication methods in HashiCorp Vault, such as userpass, LDAP, TOTP MFA, and certificate-based systems, some of which have been present for nearly a decade. These logic flaws allow attackers to bypass authentication processes, impersonate users, escalate privileges, and potentially achieve full system compromise through plugin interface abuse.
Notably, this was the first public disclosure of an RCE exploit in HashiCorp Vault’s 10-year history. The flaws enabled attackers to access stored credentials and execute remote code, which could have devastating consequences for organizations relying on these systems to safeguard their sensitive data.
Both HashiCorp and CyberArk have responded promptly to these findings by releasing patches to address the vulnerabilities. Detailed security bulletins have been published by both vendors, providing information on the fixes and reinforcing the need for robust, continually evolving security measures within critical infrastructure protection.
This research underscores the potential for subtle logic bugs to undermine even memory-safe software, emphasizing the importance of ongoing scrutiny and enhancement in the security design of credential vaulting solutions.

Collections

Security researchers discovered 14 critical vulnerabilities in HashiCorp Vault and CyberArk Conjur, including authentication bypasses, MFA evasion, privilege escalation, and remote code execution. The flaws affected multiple authentication methods and represented the first public RCE exploit in Vault's 10-year history. Both vendors have released patches and security bulletins to address these issues.

Security Researchers Uncover Zero-Day Vulnerabilities in HashiCorp Vault