HashiCorp Vault KV V2 Secret Deletion Policy Bypass Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in HashiCorp Vault's KV V2 secrets engine, affecting both the Community and Enterprise editions. An authenticated user with access to a KV V2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write. This issue arises from a policy deletion oversight, allowing unauthorized secret deletions, which could disrupt services relying on those secrets. The vulnerability does not permit deletion of secrets across namespaces or access to secret data.

Impact

Exploitation of this vulnerability can lead to unauthorized deletion of secrets, causing potential disruptions in applications or services that rely on those secrets.

Remediation

Users are advised to upgrade to Vault Community Edition 2.0.0 or Vault Enterprise versions 2.0.0, 1.21.5, 1.20.10, or 1.19.16.