# Hashicorp Vault


- [CVE-2020-35192](https://insights.sbomify.com/CVE-2020-35192/): Hardcoded credentials in n/a (critical 9.8)
- [CVE-2020-12757](https://insights.sbomify.com/CVE-2020-12757/): Improper Input Validation in HashiCorp Vault (critical 9.8)
- [CVE-2025-6000](https://insights.sbomify.com/CVE-2025-6000/): Arbitrary Remote Code Execution via Plugin Catalog Abuse (critical 9.1)
- [CVE-2022-40186](https://insights.sbomify.com/CVE-2022-40186/): HashiCorp Vault vulnerable to incorrect metadata access (critical 9.1)
- [CVE-2022-36129](https://insights.sbomify.com/CVE-2022-36129/): Missing authorization in n/a (critical 9.1)
- [CVE-2020-10661](https://insights.sbomify.com/CVE-2020-10661/): HashiCorp Vault Improper Privilege Management (critical 9.1)
- [CVE-2020-16250](https://insights.sbomify.com/CVE-2020-16250/): Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault (high 8.2)
- [CVE-2020-16251](https://insights.sbomify.com/CVE-2020-16251/): HashiCorp Vault Authentication bypass (high 8.2)
- [CVE-2026-3605](https://insights.sbomify.com/CVE-2026-3605/): Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service (high 8.1)
- [CVE-2025-11621](https://insights.sbomify.com/CVE-2025-11621/): Vault AWS auth method bypass due to AWS client cache (high 8.1)
- [CVE-2024-2048](https://insights.sbomify.com/CVE-2024-2048/): Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates (high 8.1)
- [CVE-2021-42135](https://insights.sbomify.com/CVE-2021-42135/): Incorrect Privilege Assignment in HashiCorp Vault (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/products/hashicorp/vault/