CVE-2021-38553: Excessively Broad Filesystem Permissions in HashiCorp Vault
Summary
CVE-2021-38553: HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0 in github.com/hashicorp/vault. Affects github.com/hashicorp/vault versions >= 1.4.0, < 1.8.0. Fixed in 1.8.0. How to fix ↓
Also tracked for
- vault · Bitnami
The same CVE-2021-38553 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Vault is a popular open-source tool used for securely storing and accessing sensitive data. It provides a centralized solution for managing secrets, encryption keys, and other confidential information. Vault is implemented in Go and is widely used in various applications and environments.
Vulnerability Detail
The underlying database of HashiCorp Vault had excessively broad filesystem permissions from version 1.4.0 until version 1.8.0. This vulnerability allowed unauthorized access to sensitive data stored in the Vault's database. Attackers with local access to the filesystem could potentially read, modify, or delete the Vault's database files, compromising the confidentiality and integrity of the stored secrets. This issue poses a significant security risk and should be addressed promptly.
How To Fix
Latest published version: v1.21.4 as of 23 Oct 2026
go get github.com/hashicorp/vault@v1.21.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.8.0
This is the first release that contains the fix.
go get github.com/hashicorp/vault@v1.8.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version as soon as possible.
Conclusion
The excessively broad filesystem permissions in HashiCorp Vault's underlying database pose a significant security risk. Upgrading to version 1.8.0 or later is crucial to mitigate this vulnerability and ensure the confidentiality and integrity of stored secrets.
See every vulnerability recorded for github.com/hashicorp/vault →
FAQ
HashiCorp Vault is an open-source tool used for securely storing and accessing sensitive data. It provides a centralized solution for managing secrets, encryption keys, and other confidential information.
This vulnerability allows unauthorized access to the underlying database of HashiCorp Vault. Attackers with local access to the filesystem could potentially read, modify, or delete the Vault's database files, compromising the confidentiality and integrity of the stored secrets.
Versions 1.4.0 to 1.8.0 of HashiCorp Vault are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade HashiCorp Vault to version 1.8.0 or later.
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/vault.
