CVE-2024-9180CWE-266

Vault Operators in Root Namespace May Elevate Their Privileges

High · published October 10, 2024

CVSS v3.1
7.2
EPSS
1%
Percentile
43.6
In the wild
Unconfirmed
What it is

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00525 · 43.6th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2024-10-10T20:54Z
EPSS history
Timeline
  • 10 OCT 20:54Z
    Vault Operators in Root Namespace May Elevate Their Privileges
    cvelistv5