CVE-2024-2048: Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-04 · updated 2026-06-17
Weakness: CWE-295

Description

Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate. In this configuration, an attacker may be able to craft a malicious certificate that could be used to bypass authentication. Fixed in Vault 1.15.5 and 1.14.10.

Affected products

HashiCorp Vault: before 1.14.10; from 1.15.0 before 1.15.5 — fixed in 1.14.10, 1.15.5
openbao: before 2.0.0 — fixed in 2.0.0

How to fix

Upgrade to a fixed version: HashiCorp Vault 1.14.10, 1.15.5; openbao 2.0.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-2048 or the next vulnerability affects your stack