Description
HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_misc
https://discuss.hashicorp.com/t/hcsec-2021-19-vault-s-ui-cached-user-viewed-secrets-between-shared-browser-sessions/28166
Third Party Advisory vendor-advisory
x_refsource_gentoo
https://security.gentoo.org/glsa/202207-01
Scores
CVSS v3
5.3
EPSS
0.0091
EPSS Percentile
55.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-212
Status
published
Products (2)
hashicorp/vault
< 1.8.0 (2 CPE variants)
hashicorp/vault
0 - 1.6.6Go
Published
Aug 13, 2021
Tracked Since
Feb 18, 2026