CVE-2020-25816: Incorrect Access Control in HashiCorp Vault
Summary
CVE-2020-25816: Token leases could outlive their TTL in HashiCorp Vault. Affects github.com/hashicorp/vault versions >= 1.0, < 1.5.4. Fixed in 1.5.4. How to fix ↓
Also tracked for
- vault · Bitnami
The same CVE-2020-25816 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Vault is an open-source tool designed for securely storing and accessing sensitive data such as API keys, passwords, and certificates. It provides a centralized solution for managing secrets and encryption keys. Vault is written in Go and is widely used in various applications and environments.
Vulnerability Detail
The vulnerability identified as CVE-2020-25816 in HashiCorp Vault and Vault Enterprise versions 1.0 to 1.5.4 is related to incorrect access control. Specifically, token leases in Vault could outlive their Time-to-Live (TTL) value, leading to potential unauthorized access to secrets and sensitive data. This vulnerability poses a critical risk as it allows attackers to bypass intended access restrictions and gain unauthorized privileges within the Vault environment.
How To Fix
Latest published version: v1.21.4 as of 23 Oct 2026
go get github.com/hashicorp/vault@v1.21.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.4
This is the first release that contains the fix.
go get github.com/hashicorp/vault@v1.5.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually revoke and recreate tokens to ensure that token leases do not outlive their TTL. This can be done by following the steps provided in the HashiCorp Vault documentation. However, it is strongly advised to upgrade to the latest version as soon as possible to fully mitigate the vulnerability.
Conclusion
The vulnerability identified as CVE-2020-25816 in HashiCorp Vault poses a critical risk to the security of sensitive data and secrets stored within the Vault environment. It is crucial to upgrade to version 1.5.4 or later to address the incorrect access control issue and prevent unauthorized access. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/hashicorp/vault →
FAQ
The vulnerability allows attackers to bypass access control mechanisms in HashiCorp Vault, potentially gaining unauthorized access to sensitive data and secrets stored within the Vault environment.
No, only versions 1.0 to 1.5.4 of HashiCorp Vault and Vault Enterprise are affected by this vulnerability. It is recommended to upgrade to version 1.5.4 or later to address the issue.
At the time of this advisory, there are no known public exploits targeting this vulnerability. However, it is crucial to apply the recommended fixes and upgrades to prevent potential exploitation.
While there is a temporary workaround available by manually revoking and recreating tokens, it is strongly recommended to upgrade to the latest version of HashiCorp Vault to fully mitigate the vulnerability.
For more detailed information about this vulnerability, including technical details and the CVE identifier, refer to the official HashiCorp Vault advisory and the associated CVE entry.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/vault.
