Critical severity · published Sep 22, 2022
CVE-2022-40186
An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3
9.1
CVSS
1%
EPSS
No
On KEV
Description
An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an entity has multiple mount accessors with shared alias names, Vault may overwrite metadata to the wrong alias due to an issue with checking the proper alias assigned to an entity. This may allow for unintended access to key/value paths using that metadata in Vault.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VA
Vault · Hashicorp
1.8.0 before 1.9.9; 1.8.0 before 1.9.9; 1.10.0 before 1.10.6; 1.10.0 before 1.10.6; 1.11.0 before 1.11.3; 1.11.0 before 1.11.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-40186
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-40186
Vendor Advisory
https://discuss.hashicorp.com
Vendor Advisory
https://discuss.hashicorp.com/t/hcsec-2022-18-vault-entity-alias-metadata-may-leak-between-aliases-with-the-same-name-assigned-to-the-same-entity/44550
Third Party Advisory
https://security.netapp.com/advisory/ntap-20221111-0008/
More from Vault
9.8
CVE-2024-2048
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate
9.8
CVE-2020-35192
The official vault docker images before 0.11.6 contain a blank password for a root user
9.8
CVE-2020-12757
HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease…
9.1
CVE-2025-6000
A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in…
9.1
CVE-2022-36129
HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the…