What’s Vulnerable › Vulnerabilities

CVE-2023-24999: Vault Fails to Verify if the AppRole SecretID Belongs to Role During a Destroy Operation

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-03-11 · updated 2026-06-17
• Weakness: CWE-863

Description

HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above.

Affected products

• HashiCorp Vault: before 1.10.11; from 1.11.0 before 1.11.8; from 1.12.0 before 1.12.4 — fixed in 1.10.11, 1.11.8, 1.12.4

How to fix

Upgrade to a fixed version: HashiCorp Vault 1.10.11, 1.11.8, 1.12.4. Check the vendor advisory for mitigations.

References

• https://discuss.hashicorp.com/t/hcsec-2023-07-vault-fails-to-verify-if-approle-secretid-belongs-to-role-during-a-destroy-operation/51305
• https://security.netapp.com/advisory/ntap-20230505-0001/
• https://discuss.hashicorp.com/t/hcsec-2023-07-vault-fails-to-verify-if-approle-secretid-belongs-to-role-during-a-destroy-operation/51305
• https://security.netapp.com/advisory/ntap-20230505-0001/

Get alerted when CVE-2023-24999 or the next vulnerability affects your stack