HashiCorp Vault and Vault Enterprise are vulnerable to an authentication bypass within the AWS Auth method, potentially allowing unauthorized access to sensitive secrets.

This is an authentication bypass vulnerability (CWE-288) occurring in the AWS Auth method. It is triggered when the bound_principal_iam role is reused across AWS accounts or utilizes wildcards, allowing an authenticated user with low privileges to escalate access.

The exploitation of this vulnerability poses a severe risk to organizational security, as it facilitates unauthorized access to the secrets managed by Vault. Given the CVSS score of 8.1, the impact is considered high, as it threatens the confidentiality and integrity of infrastructure credentials. Successful exploitation could lead to widespread unauthorized access across integrated cloud environments, resulting in significant data exposure and potential regulatory non-compliance.

Immediate Action: Update HashiCorp Vault Community Edition to version 1.21.0 or apply the corresponding enterprise fix (1.21.0, 1.20.5, 1.19.11, or 1.16.27) immediately.

Proactive Monitoring: Review Vault access logs for suspicious authentication patterns, specifically focusing on AWS Auth method requests involving wildcard principal configurations or cross-account role usage.

Compensating Controls: Limit the use of wildcard patterns in IAM principal definitions and ensure strict isolation between AWS accounts to reduce the attack surface until patches are deployed.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a significant security oversight in the AWS Auth integration for HashiCorp Vault. Organizations should prioritize the upgrade path provided by HashiCorp to ensure that authentication bypass vectors are effectively neutralized. Failure to patch may leave your centralized secret management infrastructure exposed to unauthorized access, making immediate action essential to maintaining your security posture.