Read the docs
TI-2022-19053 Aliases CVE-2022-40186GHSA-7cgv-v83v-rr87

An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3.

Priority MEDIUM 49CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-639.

Summary

An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an entity has multiple mount accessors with shared alias names, Vault may overwrite metadata to the wrong alias due to an issue with checking the proper alias assigned to an entity. This may allow for unintended access to key/value paths using that metadata in Vault.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01002 63rd percentileScored 2026-11-07
Fix Partial github.com/hashicorp/vault (Go): 1.11.3, 1.10.6, 1.9.9Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/hashicorp/vault (Go)1.11.0 to before 1.11.31.11.3Patch availableGHSA-7cgv-v83v-rr87
—github.com/hashicorp/vault (Go)1.10.0 to before 1.10.61.10.6Patch availableGHSA-7cgv-v83v-rr87
—github.com/hashicorp/vault (Go)1.8.0 to before 1.9.91.9.9Patch availableGHSA-7cgv-v83v-rr87
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/hashicorp/vault (Go) Vendor— Affected 1.11.0 to before 1.11.3 Fixed in 1.11.3 Patch available GHSA-7cgv-v83v-rr87
  • github.com/hashicorp/vault (Go) Vendor— Affected 1.10.0 to before 1.10.6 Fixed in 1.10.6 Patch available GHSA-7cgv-v83v-rr87
  • github.com/hashicorp/vault (Go) Vendor— Affected 1.8.0 to before 1.9.9 Fixed in 1.9.9 Patch available GHSA-7cgv-v83v-rr87

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*1.8.0 to before 1.9.9VulnerableHashiCorp
cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*1.8.0 to before 1.9.9VulnerableHashiCorp
cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*1.10.0 to before 1.10.6VulnerableHashiCorp
cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*1.10.0 to before 1.10.6VulnerableHashiCorp
cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*1.11.0 to before 1.11.3VulnerableHashiCorp
cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*1.11.0 to before 1.11.3VulnerableHashiCorp
  • cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:* Versions 1.8.0 to before 1.9.9 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:* Versions 1.8.0 to before 1.9.9 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:* Versions 1.10.0 to before 1.10.6 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:* Versions 1.10.0 to before 1.10.6 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:* Versions 1.11.0 to before 1.11.3 Vulnerable ·HashiCorp
  • cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:* Versions 1.11.0 to before 1.11.3 Vulnerable ·HashiCorp

Remediation

  • Fix · GHSA-7cgv-v83v-rr87 github.com/hashicorp/vault (Go) Fixed in 1.11.3 Advisory →
  • Fix · GHSA-7cgv-v83v-rr87 github.com/hashicorp/vault (Go) Fixed in 1.10.6 Advisory →
  • Fix · GHSA-7cgv-v83v-rr87 github.com/hashicorp/vault (Go) Fixed in 1.9.9 Advisory →

Red Hat 1 advisory

  • RHSA-2023:2023 Released 2023-04-26 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.11.7 Bug Fix and security update
    • RHODF 4.11 for RHEL 8 odf4/rook-ceph-rhel8-operator, odf4/rook-ceph-rhel9-operator

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Openshift Data Foundation 4AffectedNo fix yet
RHODF 4.11 for RHEL 8Fixed RHSA-2023:2023
Not affected: 5 products
  • Logging Subsystem for Red Hat OpenShift
  • RHODF 4.11 for RHEL 8
  • Red Hat OpenShift Container Platform 4
  • Red Hat Openshift Container Storage 4
  • Red Hat Openshift Data Foundation 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-40186
  2. 2026-10-03 Alias added: GHSA-7cgv-v83v-rr87

References

Advisory 4

Other 2

  • TI-2024-01904 Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates CVSS 3.1CRITICAL 9.8
  • TI-2020-17874 The official vault docker images before 0.11.6 contain a blank password for a root user. CVSS 3.1CRITICAL 9.8
  • TI-2020-10142 HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP… CVSS 3.1CRITICAL 9.8
  • TI-2026-04407 Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS CVSS 3.1HIGH 8.6
  • TI-2025-05421 Arbitrary Remote Code Execution via Plugin Catalog Abuse CVSS 3.1CRITICAL 9.1
  • TI-2022-16551 HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using… CVSS 3.1CRITICAL 9.1
See all 71 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences