CVE-2021-3282

HIGH

HashiCorp Vault Enterprise <1.6.2 - Privilege Escalation

Title source: llm

Description

HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_misc

https://discuss.hashicorp.com/t/hcsec-2021-04-vault-enterprise-s-dr-secondaries-allowed-raft-peer-removal-without-authentication/20337

Third Party Advisory vendor-advisory x_refsource_gentoo

https://security.gentoo.org/glsa/202207-01

Scores

CVSS v3 7.5

EPSS 0.0032

EPSS Percentile 54.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE

CWE-287

Status published

Products (3)

hashicorp/vault 1.6.0

hashicorp/vault 1.6.1

hashicorp/vault 1.6.0 - 1.6.2Go

Published Feb 01, 2021

Tracked Since Feb 18, 2026