Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2021-42135: HashiCorp Vault 1.8.x May Grant Unintended Access to Google Cloud Secrets
CVE-2021-42135 · published 5 years ago
Summary
Using certain policies, Vault users may gain more permissions than intended when interacting with Google Cloud secrets, potentially allowing them to access sensitive credentials. This affects versions 1.8.x through 1.8.4 of HashiCorp Vault and Vault Enterprise. To mitigate, users should review and update their policies to ensure they align with intended access levels.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | hashicorp | >= 1.8.0, <= 1.8.4 |
| – | hashicorp | vault |
>= 1.8.0, <= 1.8.4 cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:* |
Original advisory text
HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have mo...
HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have more privileges than intended, e.g., a user with read permission for the /gcp/roleset/* path may be able to issue Google Cloud service account credentials.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-266Incorrect Privilege Assignment
CWE-863Incorrect Authorization
CWE-269Improper Privilege Management
Timeline
Published11 Oct 2021
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta