Description
A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
HashiCorp Vault
Default version status: unaffected
0.8.0 to < 1.20.1affected
HashiCorp Vault Enterprise
Default version status: unaffected
0.8.0 to < 1.20.1affected