CVE-2024-7594
CVSS 3.1 Score 7.5 of 10 (high)
Details
Published Sep 26, 2024
Updated: Jan 10, 2025
CWE ID 732
Summary
CVE-2024-7594 is a vulnerability affecting Vault's SSH secrets engine. By default, the engine did not require the valid_principals list to have a value, allowing an SSH certificate presented by an authorized user to authenticate as any user on the host. This issue posed a significant security risk, as it bypassed the intended access control. The vulnerability has been addressed in Vault Community Edition 1.17.6 and in Vault Enterprise versions 1.17.6, 1.16.10, and 1.15.15.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- HashiCorp Vault
- Vault Enterprise
Affected Vendors
- HashiCorp Inc.