Description
HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease duration instead of the engine-configured setting. This may lead to generated GCP credentials being valid for longer than intended. Fixed in 1.4.2.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://www.hashicorp.com/blog/category/vault/
Release Notes, Vendor Advisory x_refsource_misc
https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#142-may-21st-2020
Scores
CVSS v3
9.8
EPSS
0.0051
EPSS Percentile
66.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-269
Status
published
Products (2)
hashicorp/vault
1.4.0 - 1.4.2 (2 CPE variants)
hashicorp/vault-plugin-secrets-gcp
0 - 0.6.2Go
Published
Jun 10, 2020
Tracked Since
Feb 18, 2026