products / hashicorp_vault

HashiCorp Vault

HashiCorp Vault stores and rotates secrets, certificates, and encryption keys. NVD tracks the open-source server as hashicorp:vault with semver-style CPE ranges suitable for version-specific risk synthesis.

api usage

Querying Vault

product slughashicorp_vault

version format1.12.0, 1.15.2

bash

curl "https://api.attestd.io/v1/check?product=hashicorp_vault&version=1.12.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Example response shape for an older 1.12.x line with known NVD ranges. Re-run against the live API after ingestion; exact risk_state depends on aggregated CVE facts for that semver.

json

{
  "product": "hashicorp_vault",
  "version": "1.12.0",
  "supported": true,
  "risk_state": "high",
  "risk_factors": [
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": false,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": "2.0.3",
  "confidence": 0.5,
  "cve_ids": [
    "CVE-2023-0620",
    "CVE-2023-0665",
    "CVE-2023-2121",
    "CVE-2023-24999",
    "CVE-2023-25000",
    "CVE-2023-3775",
    "CVE-2023-4680",
    "CVE-2023-5077",
    "CVE-2023-6337",
    "CVE-2024-2048",
    "CVE-2024-5798",
    "CVE-2024-6468",
    "CVE-2024-7594",
    "CVE-2024-8185",
    "CVE-2024-8365",
    "CVE-2024-9180",
    "CVE-2025-11621",
    "CVE-2025-3879",
    "CVE-2025-4166",
    "CVE-2025-5999",
    "CVE-2025-6000",
    "CVE-2025-6011",
    "CVE-2025-6013",
    "CVE-2025-6014",
    "CVE-2025-6015",
    "CVE-2025-6037",
    "CVE-2026-12624",
    "CVE-2026-3605",
    "CVE-2026-4525",
    "CVE-2026-5807"
  ],
  "cves": null,
  "max_epss": 0.00867,
  "last_updated": "2026-08-11T16:53:15.814619Z",
  "supply_chain": null,
  "supply_chain_monitored": false,
  "typosquat": null
}

cleaner line

1.17.0 is a representative newer release line for a spot check after NVD cycles.

bash

curl "https://api.attestd.io/v1/check?product=hashicorp_vault&version=2.0.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

CVE	Description	Affects	CVSS
`CVE-2020-16250`	AWS IAM authentication security bypass (KV v2).	see NVD	9.8
`CVE-2022-41338`	Integrated storage rollback race / ACL failure.	see NVD	7.5
`CVE-2023-24999`	JWT signature bypass in plugin auth path.	see NVD	9.8

All products Kubernetes API Server Response Field Reference