VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/hashicorp/vault: vulnerability history, versions and safety

github.com/hashicorp/vault is a package in the Go ecosystem. Vulert records 112 vulnerabilities for it across 120 releases, from May 2021 to Jun 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
112 vulnerabilities recorded C6 H23 M23 L4 U56
i
9 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
12 in the last 12 months

Most recent disclosure 25 Jun 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/hashicorp/vault vulnerabilities

Vulert verdict on github.com/hashicorp/vault v1.21.4 i

Updated on 23 Oct 2026

Careful: 9 of the 112 vulnerabilities Vulert records for this package have no fix yet. Plan around those, or apply the workaround listed for each. The rest have a fixed version to move to.

Package health score 62/100
  • Security Unfixed issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Moderate

What to do: Plan around the 9 vulnerabilities with no published fix: each lists the affected range and any workaround that reduces exposure. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v1.21.4 — unaffected i
  • Vulnerabilities on record 112 over 5 years · 12 in the last year i
  • Latest disclosure 25 Jun 2026 i
  • Highest CVSS 9.8 i
  • With no published fix 9 i
  • Stars 36,416 i
  • OpenSSF scorecard 5/10 i
  • Last release this month i
  • Licence MIT i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/hashicorp/vault, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20261022190156-bcaa7b6fa9ac 22 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261022190156-bcaa7b6fa9ac 22 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261021230208-f44136749125 21 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261021230208-f44136749125 21 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261021200223-81689e8a07c9 21 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261021200223-81689e8a07c9 21 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261021190207-0de5451f9b82 21 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261021190207-0de5451f9b82 21 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261021180237-46921b74ca90 21 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261021170308-fe1a8f587dce 21 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261021160515-fd6e736aeee1 21 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261021150330-481a15d9cd9f 21 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261020220251-c2b4ff565008 20 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261020220251-c2b4ff565008 20 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261020200241-baf295efd476 20 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261020200241-baf295efd476 20 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261020180231-5c685a75fbd1 20 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261020180231-5c685a75fbd1 20 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261020170240-0d81f956210a 20 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261020170240-0d81f956210a 20 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261019210308-f1f46a64bc34 19 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261019210308-f1f46a64bc34 19 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261019120337-88da4ce9a65f 19 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261019120337-88da4ce9a65f 19 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261016210216-7649ad40d88b 16 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261016210216-7649ad40d88b 16 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261016170214-04ea96403b96 16 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261016170214-04ea96403b96 16 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261016080305-59bdc457f69e 16 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261016080305-59bdc457f69e 16 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261015230214-9de2e95112ab 15 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261015230214-9de2e95112ab 15 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261015220224-dccef5c95068 15 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261015210235-d8c6dacbfd49 15 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261015210235-d8c6dacbfd49 15 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261015200235-9c511041c027 15 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261015200235-9c511041c027 15 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261015180309-4333613121f2 15 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261015180309-4333613121f2 15 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261015170215-40f3ee7b6319 15 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261015170215-40f3ee7b6319 15 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261014200252-54e414945860 14 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261014200252-54e414945860 14 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261014192408-2891bfd23893 14 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261014190253-7d2217beb7c5 14 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261014190253-7d2217beb7c5 14 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261014180223-ebff17f22696 14 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261014180223-ebff17f22696 14 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261013170311-a0b7a503f721 13 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261013170311-a0b7a503f721 13 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261012220232-fdd82cfd09d5 12 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261012220232-fdd82cfd09d5 12 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261012210214-7fd6041639db 12 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261012210214-7fd6041639db 12 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261012190328-27075472cc60 12 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261012190328-27075472cc60 12 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261012170151-cfcf95aa6f7e 12 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261012170151-cfcf95aa6f7e 12 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261012000423-96f08e99d70f 12 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261012000423-96f08e99d70f 12 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261009210246-eb955f080736 09 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261009210246-eb955f080736 09 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261009200227-d342b507dddf 09 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261009200227-d342b507dddf 09 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261009180305-b146c5fa8db6 09 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261009180305-b146c5fa8db6 09 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261009160343-1f84b7a0f0aa 09 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261009160343-1f84b7a0f0aa 09 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261009150250-0314b3726af5 09 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261009150250-0314b3726af5 09 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261008220244-af0192cf1bfe 08 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261008220244-af0192cf1bfe 08 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261008200217-efdeed060819 08 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261008200217-efdeed060819 08 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261008190338-9106f7c1f430 08 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261008190338-9106f7c1f430 08 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261008184040-e413b349bf9e 08 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261008170252-6fe4b77f211a 08 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261008170252-6fe4b77f211a 08 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261008150231-9fc3b1077a70 08 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261008071238-d25076629ae7 08 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261008071238-d25076629ae7 08 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261008012435-42f455fdaba7 08 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261008012435-42f455fdaba7 08 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261007220256-e62d0ac64218 07 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261007220256-e62d0ac64218 07 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261007210255-49c1bcda2bca 07 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261007210255-49c1bcda2bca 07 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261007190411-98fabd7d7169 07 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261007190411-98fabd7d7169 07 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261007171029-12c78b97a730 07 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261007171029-12c78b97a730 07 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261007160349-13e1c0a22e7e 07 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261007160349-13e1c0a22e7e 07 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261007150245-27e014d3ed5c 07 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261007140223-4fed2d940d64 07 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261007140223-4fed2d940d64 07 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261007130845-80851f21691d 07 Oct 2026 H6 M10 L2 U20 MIT No Details →
v1.2.1-0.20261007130845-80851f21691d 07 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261007000359-715f20ae9ca4 07 Oct 2026 H6 M10 L2 U20 MIT No Details →
v0.0.0-20261006210218-d66d0a56982b 06 Oct 2026 H6 M10 L2 U20 — No Details →
v1.2.1-0.20261006210218-d66d0a56982b 06 Oct 2026 H6 M10 L2 U20 — No Details →
v0.0.0-20261006191737-76fdd6587523 06 Oct 2026 H6 M10 L2 U20 — No Details →
v1.2.1-0.20261006191737-76fdd6587523 06 Oct 2026 H6 M10 L2 U20 — No Details →
v0.0.0-20261006180225-773ad017f954 06 Oct 2026 H6 M10 L2 U20 — No Details →
v1.2.1-0.20261006180225-773ad017f954 06 Oct 2026 H6 M10 L2 U20 — No Details →
v0.0.0-20261006150240-adf8d59e9107 06 Oct 2026 H6 M10 L2 U20 — No Details →
v1.2.1-0.20261006150240-adf8d59e9107 06 Oct 2026 H6 M10 L2 U20 — No Details →
v0.0.0-20261006140259-bc26f9d09063 06 Oct 2026 H6 M10 L2 U20 — No Details →
v1.2.1-0.20261006140259-bc26f9d09063 06 Oct 2026 H6 M10 L2 U20 — No Details →
v0.0.0-20261006071013-6fb04ce7853d 06 Oct 2026 H6 M10 L2 U20 — No Details →
v1.2.1-0.20261006071013-6fb04ce7853d 06 Oct 2026 H6 M10 L2 U20 — No Details →
v0.0.0-20261005210215-11f72f444186 05 Oct 2026 H6 M10 L2 U20 — No Details →
v1.2.1-0.20261005210215-11f72f444186 05 Oct 2026 H6 M10 L2 U20 — No Details →
v0.0.0-20261005200228-2c9ef0faa1ab 05 Oct 2026 H6 M10 L2 U20 — No Details →
v0.0.0-20261005190554-d084bd4e2557 05 Oct 2026 H6 M10 L2 U20 — No Details →
v1.2.1-0.20261005190554-d084bd4e2557 05 Oct 2026 H6 M10 L2 U20 — No Details →
v0.0.0-20261005170227-96ed988987b5 05 Oct 2026 H6 M10 L2 U20 — No Details →
v1.2.1-0.20261005170227-96ed988987b5 05 Oct 2026 H6 M10 L2 U20 — No Details →
v0.0.0-20261005160232-c6b1d535009e 05 Oct 2026 H6 M10 L2 U20 — No Details →

The newest 120 of 11,643 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 9
  • 2022 3
  • 2023 14
  • 2024 50
  • 2025 28
  • 2026 8

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 12 of the 112 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/hashicorp/vault

The 5 most severe of 112 vulnerabilities recorded for this package

Search all 112 in the database →
Vulnerability Severity Fixed version ↑ Disclosed ↑
CVE-2021-38553: Excessive Filesystem Permissions in HashiCorp Vault 9.8 critical 1.8.0 30 Aug 2021
CVE-2020-25816: Incorrect Access Control in HashiCorp Vault 9.8 critical 1.5.4 24 May 2022
CVE-2021-43998: HashiCorp Vault Incorrect Permission Assignment for Critical Resource 9.1 critical 1.7.6 02 Dec 2021
CVE-2022-40186: HashiCorp Vault Incorrect Metadata Access 9.1 critical 1.11.3 23 Sep 2022
CVE-2025-6000: Hashicorp Vault Code Execution Vulnerability via Plugin Configuration 9.1 critical 1.20.1 01 Aug 2025

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/hashicorp/vault

Is github.com/hashicorp/vault safe to use?

Vulert records 112 vulnerabilities for github.com/hashicorp/vault in Go: 6 critical, 23 high, 23 medium and 4 low, plus 56 not yet rated. 9 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/hashicorp/vault's Vulert package health score?

Vulert scores github.com/hashicorp/vault 62/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Which version of github.com/hashicorp/vault should I use?

v1.21.4 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/hashicorp/vault have?

112 vulnerabilities are recorded for github.com/hashicorp/vault in the Go ecosystem: 6 critical, 23 high, 23 medium and 4 low, plus 56 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/hashicorp/vault vulnerabilities disclosed?

12 vulnerabilities were recorded for github.com/hashicorp/vault in the last 12 months, and the oldest entry in this database dates to 18 May 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/hashicorp/vault are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/hashicorp/vault for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/hashicorp/vault version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.