cve.bz

CVE-2021-32923

7.4 highEPSS 1.4%

High (7.4) in hashicorp vault. EPSS 1.4% chance of exploitation in the next 30 days. Fixed in github.com/hashicorp/vault 1.5.9, 1.6.5, 1.7.2.

HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.

Severity

CVSS 3.1

7.4 high
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS
1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
CWE
CWE-613
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-38j9-7pp9-2hjwGogithub.com/hashicorp/vault>=1.7.0 <1.7.21.7.2
GHSA-38j9-7pp9-2hjwGogithub.com/hashicorp/vault>=1.6.0 <1.6.51.6.5
GHSA-38j9-7pp9-2hjwGogithub.com/hashicorp/vault>=0.10.0 <1.5.91.5.9
GO-2022-0623Gogithub.com/hashicorp/vault>=0.10.0 <1.5.9
>=1.6.0 <1.6.5
>=1.7.0 <1.7.2		1.5.9, 1.6.5, 1.7.2

References

Check your stackJSON