CVE-2023-3775 Vault Enterprise's Sentinel RGP Policies Allowed For Cross-Namespace Denial of Service

What is CVE-2023-3775?

CVE-2023-3775 is a medium-severity denial of service vulnerability in Hashicorp Vault, published on 28 Sep 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespace can be applied to requests outside in another non-descendant namespace, potentially resulting in denial of service. Fixed in Vault Enterprise 1.15.0, 1.14.4, 1.13.8.

Weakness: CWE-266

Which versions are affected by CVE-2023-3775?

1 open source package ship an affected version, including vault. It affects 1 product.

Products include Hashicorp Vault.

How do I fix CVE-2023-3775?

Upgrade vault to a fixed version for your release line: 1.13.8 or 1.14.4.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-3775 being exploited?

There is no known exploitation of CVE-2023-3775 in the wild and no public exploit code.

Other vulnerabilities in Hashicorp Vault

• CVE-2020-35192 Hardcoded credentials in n/a Critical 9.8
• CVE-2020-12757 Improper Input Validation in HashiCorp Vault Critical 9.8
• CVE-2025-6000 Arbitrary Remote Code Execution via Plugin Catalog Abuse Critical 9.1
• CVE-2022-40186 HashiCorp Vault vulnerable to incorrect metadata access Critical 9.1
• CVE-2022-36129 Missing authorization in n/a Critical 9.1

All Hashicorp Vault vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-vault-2023-3775, GHSA-37gg-8xjr-m6x4.