Skip to content
Noroxi

HashiCorp records

194 published records for vendor hashicorp.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
2
With a fix record
85.1%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

194 records
  • CVE-2021-41805
    45Plan

    HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control.

    HighCVSS 8.8Proof of conceptEPSS 34%

    hashicorp · consulDec 12, 2021

  • CVE-2020-29564
    41Plan

    The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user.

    CriticalCVSS 9.8No exploitEPSS 6%

    hashicorp · consul docker imageDec 8, 2020

  • CVE-2020-35192
    40Plan

    The official vault docker images before 0.11.6 contain a blank password for a root user.

    CriticalCVSS 9.8No exploitEPSS 2%

    hashicorp · vaultDec 16, 2020

  • CVE-2019-12618
    40Plan

    HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver.

    CriticalCVSS 9.8No exploitEPSS 2%

    hashicorp · nomadAug 12, 2019

  • CVE-2018-9057
    40Plan

    aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriat

    CriticalCVSS 9.8No exploitEPSS 1%

    hashicorp · terraformMar 27, 2018

  • CVE-2022-26945
    40Plan

    go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response he

    CriticalCVSS 9.8No exploitEPSS 1%

    hashicorp · go-getterMay 25, 2022

  • CVE-2021-30476
    39Monitor

    HashiCorp Terraform’s Vault Provider (terraform-provider-vault) did not correctly configure GCE-type bound labels for Vault’s GCP auth metho

    CriticalCVSS 9.8No exploitEPSS 1%

    hashicorp · terraform providerApr 22, 2021

  • CVE-2020-12757
    39Monitor

    HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials

    CriticalCVSS 9.8No exploitEPSS 1%

    hashicorp · vaultJun 10, 2020

  • CVE-2022-30324
    39Monitor

    HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation thro

    CriticalCVSS 9.8No exploitEPSS 1%

    hashicorp · nomadJun 2, 2022

  • CVE-2024-3817
    39Monitor

    HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches

    CriticalCVSS 9.8No exploitEPSS 1%

    hashicorp · go-getterApr 17, 2024

  • CVE-2020-7956
    39Monitor

    HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and

    CriticalCVSS 9.8No exploitEPSS 0%

    hashicorp · nomadJan 31, 2020

  • CVE-2023-1782
    39Monitor

    Nomad Unauthenticated Client Agent HTTP Request Privilege Escalation

    CriticalCVSS 9.8No exploitEPSS 0%

    hashicorp · nomadApr 5, 2023

  • CVE-2025-13357
    39Monitor

    Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method

    CriticalCVSS 9.8No exploitEPSS 0%

    hashicorp · terraform providerNov 21, 2025

  • CVE-2022-36130
    39Monitor

    HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scop

    CriticalCVSS 9.9No exploitEPSS 0%

    hashicorp · boundaryAug 31, 2022

  • CVE-2024-2048
    39Monitor

    Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates

    CriticalCVSS 9.8No exploitEPSS 0%

    hashicorp · vaultMar 4, 2024

  • CVE-2022-36129
    36Monitor

    HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint

    CriticalCVSS 9.1No exploitEPSS 1%

    hashicorp · vaultJul 26, 2022

  • CVE-2020-27195
    36Monitor

    HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or ar

    CriticalCVSS 9.1No exploitEPSS 1%

    hashicorp · nomadOct 22, 2020

  • CVE-2020-10661
    36Monitor

    HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies gran

    CriticalCVSS 9.1No exploitEPSS 1%

    hashicorp · vaultMar 23, 2020

  • CVE-2022-40186
    36Monitor

    An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3.

    CriticalCVSS 9.1No exploitEPSS 1%

    hashicorp · vaultSep 21, 2022

  • CVE-2025-6000
    36Monitor

    Arbitrary Remote Code Execution via Plugin Catalog Abuse

    CriticalCVSS 9.1No exploitEPSS 0%

    hashicorp · vaultAug 1, 2025

  • CVE-2025-0377
    36Monitor

    HashiCorp go-slug Vulnerable to Zip Slip Attack

    CriticalCVSS 9.1No exploitEPSS 0%

    hashicorp · go-slugJan 21, 2025

  • CVE-2021-3121
    35Monitor

    An issue was discovered in GoGo Protobuf before 1.3.2.

    HighCVSS 8.6No exploitEPSS 3%

    golang · protobufJan 11, 2021

  • CVE-2022-30321
    35Monitor

    go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws

    HighCVSS 8.6No exploitEPSS 3%

    hashicorp · go-getterMay 25, 2022

  • CVE-2021-43415
    35Monitor

    HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job

    HighCVSS 8.8No exploitEPSS 1%

    hashicorp · nomadDec 3, 2021

  • CVE-2021-37219
    35Monitor

    HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to acce

    HighCVSS 8.8No exploitEPSS 1%

    hashicorp · consulSep 7, 2021