Invalid session token expiration in github.com/hashicorp/vault
Summary
CVE-2021-32923: Invalid session token expiration in github.com/hashicorp/vault. Affects github.com/hashicorp/vault across 3 version ranges.
>= 0.10.0, < 1.5.9
>= 1.6.0, < 1.6.5
>= 1.7.0, < 1.7.2
Fixed in 1.5.9, 1.6.5 or 1.7.2, depending on the release line you run. How to fix ↓
Also tracked for
- vault · Bitnami
The same CVE-2021-32923 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/hashicorp/vault is an open-source project written in Go that provides secure storage and access to secrets. It is widely used for managing sensitive information such as API keys, passwords, and certificates. However, a vulnerability has been discovered in the session token expiration mechanism of Vault.
Vulnerability Detail
The vulnerability in github.com/hashicorp/vault allows session tokens to have an invalid expiration time. This means that an attacker could potentially use an expired session token to gain unauthorized access to sensitive information stored in Vault. The impact of this vulnerability could be severe, as it could lead to the exposure of confidential data and compromise the security of the entire system.
How To Fix
Latest published version: v1.21.4 as of 23 Oct 2026
go get github.com/hashicorp/vault@v1.21.4Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.10.0, < 1.5.91.5.9go get github.com/hashicorp/vault@v1.5.9 -
>= 1.6.0, < 1.6.51.6.5go get github.com/hashicorp/vault@v1.6.5 -
>= 1.7.0, < 1.7.21.7.2go get github.com/hashicorp/vault@v1.7.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to a fixed version of github.com/hashicorp/vault to mitigate the risk.
Conclusion
The vulnerability in github.com/hashicorp/vault's session token expiration mechanism can potentially allow unauthorized access to sensitive information. It is crucial to update to a fixed version of the package to mitigate the risk and ensure the validity of session tokens.
See every vulnerability recorded for github.com/hashicorp/vault →
FAQ
github.com/hashicorp/vault is an open-source project that provides secure storage and access to secrets.
A session token is a temporary credential that allows authenticated access to Vault's secrets and functionalities.
An attacker could exploit this vulnerability by using an expired session token to gain unauthorized access to sensitive information stored in Vault.
The impact of this vulnerability could be severe, as it could lead to the exposure of confidential data and compromise the security of the entire system.
To fix this vulnerability, it is recommended to update to a version of github.com/hashicorp/vault that includes the fix.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/vault.
