CVE-2021-41802: Incorrect Permission Assignment for Critical Resource

October 12, 2021 (updated October 20, 2021)

HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4.

References

github.com/advisories/GHSA-qv95-g3gm-x542
nvd.nist.gov/vuln/detail/CVE-2021-41802

Code Behaviors & Features

Detect and mitigate CVE-2021-41802 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →