Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a no...

CVE-2022-36129 · published 4 years ago
Summary

HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. Fixed...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
hashicorp vault >= 1.7.0, <= 1.9.7
>= 1.10.0, <= 1.10.4
1.11.0
cpe:2.3:a:hashicorp:vault:*:*:*:*:*:*:*:*
Original advisory text
HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a no...
HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. Fixed in Vault Enterprise 1.9.8, 1.10.5, and 1.11.1.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
9.1 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published26 Jul 2022
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2022-36129 · NVD
CVE-2022-36129 · OSV
Track software like this
Free during beta