Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-7594

Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15.

Published

2024-09-26T20:15:07.687

Last Modified

2025-11-13T17:51:32.390

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

Weaknesses
  • Type: Secondary
    CWE-732
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application hashicorp vault < 1.15.15 Yes
Application hashicorp vault < 1.17.6 Yes
Application hashicorp vault < 1.16.10 Yes
Application hashicorp vault < 1.17.6 Yes
Application openbao openbao < 2.0.2 Yes
References