TI-2020-10142 Aliases CVE-2020-12757 GHSA-75pc-qvwc-jf3g

HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP…

MEDIUM 45CWE-269Published 2020-06-10 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Privilege escalation
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-269.

Summary

HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease duration instead of the engine-configured setting. This may lead to generated GCP credentials being valid for longer than intended. Fixed in 1.4.2.

Why it matters now

EPSS 0.0156 75th percentileScored 2026-11-07

Fix Partial github.com/hashicorp/vault-plugin-secrets-gcp (Go): 0.6.2Red Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	github.com/hashicorp/vault-plugin-secrets-gcp (Go)	before 0.6.2	0.6.2	Patch available	GHSA-75pc-qvwc-jf3g

— Vendor— Affected all versions Fixed in — No fix listed CNA
github.com/hashicorp/vault-plugin-secrets-gcp (Go) Vendor— Affected before 0.6.2 Fixed in 0.6.2 Patch available GHSA-75pc-qvwc-jf3g

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:hashicorp:vault:::::-:::*	1.4.0 to before 1.4.2	Vulnerable	HashiCorp
cpe:2.3:a:hashicorp:vault:::::enterprise:::*	1.4.0 to before 1.4.2	Vulnerable	HashiCorp

cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:* Versions 1.4.0 to before 1.4.2 Vulnerable ·HashiCorp
cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:* Versions 1.4.0 to before 1.4.2 Vulnerable ·HashiCorp

Remediation

Fix · GHSA-75pc-qvwc-jf3g github.com/hashicorp/vault-plugin-secrets-gcp (Go) Fixed in 0.6.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Openshift Container Storage 4	Affected	No fix planned: Out of support scope

Not affected: 3 products

Logging Subsystem for Red Hat OpenShift
Red Hat OpenShift Container Platform 4
Red Hat Openshift Data Foundation 4

Timeline

2026-10-02 Threatist record created from CVE-2020-12757
2026-10-03 Alias added: GHSA-75pc-qvwc-jf3g

References

Advisory 3

Other 4

TI-2024-01904 Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates CVSS 3.1CRITICAL 9.8
TI-2022-19053 An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. CVSS 3.1CRITICAL 9.1
TI-2020-17874 The official vault docker images before 0.11.6 contain a blank password for a root user. CVSS 3.1CRITICAL 9.8
TI-2026-04407 Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS CVSS 3.1HIGH 8.6
TI-2025-05421 Arbitrary Remote Code Execution via Plugin Catalog Abuse CVSS 3.1CRITICAL 9.1
TI-2022-16551 HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using… CVSS 3.1CRITICAL 9.1

See all 71 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences