CVE-2022-40186: HashiCorp Vault Incorrect Metadata Access
Summary
CVE-2022-40186: HashiCorp Vault vulnerable to incorrect metadata access. Affects github.com/hashicorp/vault across 3 version ranges.
>= 1.8.0, < 1.9.9
>= 1.10.0, < 1.10.6
>= 1.11.0, < 1.11.3
Fixed in 1.9.9, 1.10.6 or 1.11.3, depending on the release line you run. How to fix ↓
Also tracked for
- vault · Bitnami
The same CVE-2022-40186 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Vault is an open-source tool designed for securely storing and accessing secrets. It provides a centralized solution for managing sensitive information such as API keys, passwords, and certificates. Vault offers various authentication methods and encryption mechanisms to ensure the confidentiality and integrity of stored data. However, a vulnerability has been discovered in versions prior to 1.11.3 that allows incorrect metadata access, potentially leading to unintended access to key/value paths in Vault.
Vulnerability Detail
The vulnerability in HashiCorp Vault arises from an issue in the Identity Engine. In deployments where an entity has multiple mount accessors with shared alias names, Vault may overwrite metadata to the wrong alias due to a flaw in checking the proper alias assigned to an entity. This can result in unauthorized access to key/value paths that rely on the affected metadata. An attacker could exploit this vulnerability to gain access to sensitive information stored in Vault, compromising the confidentiality and integrity of the data.
How To Fix
Latest published version: v1.21.4 as of 23 Oct 2026
go get github.com/hashicorp/vault@v1.21.4Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.8.0, < 1.9.91.9.9go get github.com/hashicorp/vault@v1.9.9 -
>= 1.10.0, < 1.10.61.10.6go get github.com/hashicorp/vault@v1.10.6 -
>= 1.11.0, < 1.11.31.11.3go get github.com/hashicorp/vault@v1.11.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched version of HashiCorp Vault.
Conclusion
The vulnerability in HashiCorp Vault allows incorrect metadata access, potentially leading to unauthorized access to key/value paths. It is crucial to upgrade to the patched version (1.11.3 or later) to mitigate the risk and protect the confidentiality and integrity of stored secrets. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/hashicorp/vault →
FAQ
HashiCorp Vault is an open-source tool for securely storing and accessing secrets, such as API keys, passwords, and certificates. It provides a centralized solution with various authentication methods and encryption mechanisms.
The vulnerability allows unauthorized access to key/value paths in HashiCorp Vault. An attacker could exploit this to gain access to sensitive information, compromising data confidentiality and integrity.
Versions prior to 1.11.3 are affected by this vulnerability. It is recommended to upgrade to the latest stable release to mitigate the risk.
No, there is no known workaround for this vulnerability. Upgrading to the patched version is the recommended solution.
You can find more information about this vulnerability in the HashiCorp Vault advisory: [link to advisory]
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/vault.
