HashiCorp Vault: new uninitialized node can be tricked into sending its server credentials to an attacker

Impact

While a new, uninitialized Vault node is joining integrated storage, an attacker who can reach it over the network can make it send credentials from its server environment to a server the attacker controls. Depending on how the node is deployed, those could be cloud or platform credentials that reach beyond Vault. Already-initialized nodes are not described as affected. The exposure is limited to the window when nodes are being added or rebuilt.

Who can reach it

Unauthenticated attacker with network access to a new, uninitialized Vault node. Attack complexity is high.

What to do

Upgrade to Vault Community Edition 2.2.2 or Vault Enterprise 2.2.2, 1.21.14 or 1.19.25. Do a rolling upgrade of each server with a daemon restart, standbys first. Until then, keep new nodes off untrusted networks until they have joined. If an uninitialized node may have been exposed, rotate the credentials in its environment.

References

Related entries

• GitLab: improper redirect validation in the Kubernetes proxy sends cluster auth tokens to an attacker-chosen serverCVE-2026-7767 · GitLab CE/EE (Kubernetes agent proxy redirect validation)Medium
• DMTF libspdm - SPDM Requester timeout handling: A libspdm Requester stores the Responder's CTExponentCVE-2023-32690 · DMTF libspdm - SPDM Requester timeout handlingMedium
• Dell OpenManage Enterprise (path traversal): An unauthenticated remote attacker reads files from the OME serverCVE-2024-25944 · Dell OpenManage Enterprise (path traversal)Medium
• Elastic Metricbeat: oversized Prometheus remote_write request drives an unbounded allocation and kills the beatCVE-2026-26931 · Elastic Metricbeat (Prometheus remote_write HTTP handler)Medium
• AMD Zen 1 / Zen 2 / Zen 3 - execution unit scheduler queue contention (SMT): AMD's split scheduler design gives eachCVE-2021-46778 · AMD Zen 1 / Zen 2 / Zen 3 - execution unit scheduler queue contention (SMT)Medium
• IBM Spectrum Scale / GPFS node file access path: An unprivileged but authenticated user on a GPFS node reads arbitraryCVE-2018-1723 · IBM Spectrum Scale / GPFS node file access pathMedium