Executive brief
HashiCorp Vault is a tool used to manage sensitive secrets and protect data. A vulnerability in its logging system could allow a highly privileged user to bypass security restrictions and write log files into sensitive system directories. This could potentially lead to the corruption of security plugins or unauthorized access to sensitive configuration areas, though it requires high-level administrative access to exploit.
Technical details
A path traversal vulnerability (CWE-22) exists in HashiCorp Vault's audit device validation logic. While Vault includes a 'plugin directory guard' to prevent audit logs from being written into sensitive plugin directories, this check only validated the 'file_path' option. The file audit backend also accepted a legacy 'path' option as a fallback, which bypassed this validation. An attacker with high privileges (sufficient to configure audit devices) could exploit this to write audit logs into the plugin directory. This issue is fixed in versions 2.0.1, 1.21.6, 1.20.11, and 1.19.17.
Affected products
- HashiCorp Vault 1.20.1 to 2.0.0; fixed in 2.0.1, 1.21.6, 1.20.11
- HashiCorp Vault Enterprise 1.19.0 to 2.0.0; fixed in 2.0.1, 1.21.6, 1.20.11, 1.19.17
Timeline
- 2026-07-01: disclosed
- 2026-07-01: patched