Enter the Vault: Authentication Issues in Hashi Corp Vault
Summary: Google Project Zero's Felix Wilhelm found two vulnerabilities, CVE-2020-16250 and CVE-2020-16251, in HashiCorp Vault's aws and gcp auth methods that can lead to authentication bypass; HashiCorp fixed them in Vault versions 1.2.5, 1.3.8, 1.4.4 and 1.5.1 released in August. The aws flaw stems from Vault forwarding client-supplied pre-signed requests to the STS GetCallerIdentity endpoint without validating URL path, query, body or headers, and from a Go XML decoder that silently ignores non-XML content around the expected root, letting an attacker spoof a caller identity.
What you should know: Vault is the central store for API keys, passwords and certificates, so an authentication bypass there hands an attacker access to a wide range of secrets and large parts of the target's infrastructure.
Read the original at Google Project Zero ↗
- Topics
- Cloud Security
- Mentions
- CVE-2020-16250
- Related
- Unexpected security footguns in Go Cyber Risks ·Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026