Riskcovery

CVE-2024-7594

Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default

State
Published
Severity
7.5 High
Published
Sep 26, 2024
Updated
Jan 10, 2025
Reserved
Aug 7, 2024

Read the record on cve.org

Description

Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HHashiCorp

Weaknesses

  • CWE-732 Incorrect Permission Assignment for Critical Resource

Affected Products

ProductVersions
VaultHashiCorp
  • 1.7.7 to before 1.17.6Affected
Vault EnterpriseHashiCorp
  • 1.7.7 to before 1.17.6Affectedfrom 1.16.10Not affectedfrom 1.15.15Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.