Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
hashicorp/vault
main @ bc8e56c
292
Fixes
48
CVEs
CRITICAL
Peak severity
40.0%
Coverage
Highlights
Auth Bypass: 128 prior fixes. Scrutinize any change in this area.
builtin/logical/pki: most-fixed (28 issues). Treat as high-risk during review.
101 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Logic flaws in ACL evaluation (such as trailing slash normalization and segment-based wildcard specificity) permit directory-level and parameter-level authorization bypasses. Overlapping glob patterns or composite parameter formats can override explicit deny rules if unchecked.
Denial of Service: Unauthenticated attackers can exhaust system memory and CPU via deeply nested JSON requests, complex audit-triggering payloads, or unbounded streaming connections before rate limiters are applied. This bypasses typical operational defenses to block legitimate client requests.
Auth Bypass: The PKI engine has historically suffered from name constraint validation bypasses (e.g., subdomain suffix mismatches), unintended wildcard issuance, and ACME challenge validation weaknesses that permit clients to obtain unauthorized certificate capabilities.