CVE-2020-12757

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-06-10 · updated 2026-06-17
Weakness: CWE-269

Description

HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease duration instead of the engine-configured setting. This may lead to generated GCP credentials being valid for longer than intended. Fixed in 1.4.2.

Affected products

HashiCorp Vault: from 1.4.0 before 1.4.2 — fixed in 1.4.2

How to fix

Upgrade to a fixed version: HashiCorp Vault 1.4.2. Check the vendor advisory for mitigations.

References

https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#142-may-21st-2020
https://www.hashicorp.com/blog/category/vault/
https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#142-may-21st-2020
https://www.hashicorp.com/blog/category/vault/

Get alerted when CVE-2020-12757 or the next vulnerability affects your stack