CVE-2022-40186 HashiCorp Vault vulnerable to incorrect metadata access

What is CVE-2022-40186?

CVE-2022-40186 is a critical missing authorization vulnerability in Hashicorp Vault, published on 22 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an entity has multiple mount accessors with shared alias names, Vault may overwrite metadata to the wrong alias due to an issue with checking the proper alias assigned to an entity. This may allow for unintended access to key/value paths using that metadata in Vault.

Weakness: CWE-639

Which versions are affected by CVE-2022-40186?

8 open source packages ship an affected version, including github.com/hashicorp/vault and vault. It affects 1 product.

Products include Hashicorp Vault.

How do I fix CVE-2022-40186?

Upgrade github.com/hashicorp/vault to a fixed version for your release line: 1.10.6, 1.11.3 or 1.9.9.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-40186 being exploited?

There is no known exploitation of CVE-2022-40186 in the wild and no public exploit code.

Other vulnerabilities in Hashicorp Vault

• CVE-2020-35192 Hardcoded credentials in n/a Critical 9.8
• CVE-2020-12757 Improper Input Validation in HashiCorp Vault Critical 9.8
• CVE-2025-6000 Arbitrary Remote Code Execution via Plugin Catalog Abuse Critical 9.1
• CVE-2022-36129 Missing authorization in n/a Critical 9.1
• CVE-2020-10661 HashiCorp Vault Improper Privilege Management Critical 9.1

All Hashicorp Vault vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-vault-2022-40186, GHSA-7cgv-v83v-rr87, GO-2022-1021.