Riskcovery

CVE-2024-2048

Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates

State
Published
Severity
8.1 High
Published
Mar 4, 2024
Updated
Feb 13, 2025
Reserved
Mar 1, 2024

Read the record on cve.org

Description

Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate. In this configuration, an attacker may be able to craft a malicious certificate that could be used to bypass authentication. Fixed in Vault 1.15.5 and 1.14.10.

Scores

CVSSScoreVectorSource
3.18.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HHashiCorp

Weaknesses

  • CWE-295 Improper Certificate Validation

Affected Products

ProductVersions
VaultHashiCorp
  • 1.15.5 to before 1.16.0Affectedfrom 1.14.10Not affected
Vault EnterpriseHashiCorp
  • 1.15.5 to before 1.16.0Affectedfrom 1.14.10Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.