CVE-2023-3462: Vault's LDAP Auth Method Allows for User Enumeration

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-31 · updated 2026-06-17
Weakness: CWE-203

Description

HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.

Affected products

HashiCorp Vault: from 1.13.0 before 1.13.5; 1.14.0 — fixed in 1.13.5

How to fix

Upgrade to a fixed version: HashiCorp Vault 1.13.5. Check the vendor advisory for mitigations.

References

https://discuss.hashicorp.com/t/hcsec-2023-24-vaults-ldap-auth-method-allows-for-user-enumeration/56714
https://discuss.hashicorp.com/t/hcsec-2023-24-vaults-ldap-auth-method-allows-for-user-enumeration/56714

Get alerted when CVE-2023-3462 or the next vulnerability affects your stack