cve.bz

CVE-2021-43998

6.5 mediumEPSS 1.0%

Medium (6.5) in hashicorp vault. EPSS 1.0% chance of exploitation in the next 30 days. Fixed in github.com/hashicorp/vault 1.7.6, 1.8.5.

HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault Enterprise 1.7.6, 1.8.5, and 1.9.0.

Severity

CVSS 3.1

6.5 medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
EPSS
1.0% chance of exploitation in the next 30 days; higher than 64% of CVEs (scores of 2026-10-31)
CWE
CWE-732
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-pfmw-vj74-ph8gGogithub.com/hashicorp/vault>=0.11.0 <1.7.61.7.6
GHSA-pfmw-vj74-ph8gGogithub.com/hashicorp/vault>=1.8.0 <1.8.51.8.5
GO-2022-0611Gogithub.com/hashicorp/vault>=0.11.0 <1.7.6
>=1.8.0 <1.8.5		1.7.6, 1.8.5

References

Check your stackJSON