A high-severity privilege escalation vulnerability in HashiCorp Vault allows authorized operators to gain unauthorized root policy access, posing a significant risk to secret management integrity.

The vulnerability is an instance of incorrect privilege assignment (CWE-266) located within the identity endpoint of the root namespace. An authenticated user with existing write permissions to this endpoint can manipulate token privileges to acquire the root policy.

This vulnerability carries a CVSS score of 7.2, indicating a high risk of unauthorized administrative control. Successful exploitation allows an attacker to bypass intended access controls, potentially resulting in full compromise of all secrets, credentials, and encryption keys managed by the affected Vault instance. Such a breach could lead to widespread system compromise, data theft, and severe regulatory non-compliance.

Immediate Action: Upgrade to Vault Community Edition 1.20.0 or the corresponding fixed Enterprise versions: 1.20.0, 1.19.6, 1.18.11, or 1.16.22.

Proactive Monitoring: Review Vault audit logs for suspicious activity involving the identity endpoint and monitor for unauthorized changes to token policies or unexpected assignments of root-level permissions.

Compensating Controls: Restrict administrative access to the root namespace identity endpoint to the absolute minimum number of trusted users until the patch can be applied.

Public Exploit Available: Unknown

Given the potential for total loss of confidentiality and integrity within the Vault environment, administrators should prioritize this update. Ensure that all instances, including Enterprise deployments, are moved to the patched versions immediately to prevent malicious escalation by internal actors or compromised accounts.