HashiCorp Vault contains a vulnerability that may expose sensitive authentication tokens to third-party auth plugins, creating a risk of unauthorized credential access.

This is an insertion of sensitive information into sent data (CWE-201) occurring when Vault is configured to pass through the Authorization header. An authenticated user can trigger this behavior, causing the system to leak the active Vault token to the plugin backend during the authentication process.

The potential for token exposure represents a significant security risk, as compromised tokens allow an attacker to impersonate legitimate users or service accounts. Given the CVSS score of 7.5, this high-severity flaw could lead to full unauthorized access within the Vault environment, potentially resulting in the exfiltration of secrets, encryption keys, or sensitive configuration data.

Immediate Action: Upgrade HashiCorp Vault or Vault Enterprise to version 2.0.0, 1.21.5, 1.20.10, or 1.19.16 to ensure proper header sanitization.

Proactive Monitoring: Review audit logs for unusual auth plugin activity or unexpected requests originating from internal plugin backends that may indicate token interception attempts.

Compensating Controls: If patching is not immediately feasible, disable the Authorization header pass-through feature for any auth mounts where sensitive tokens are utilized for authentication.

Public Exploit Available: Unknown

This vulnerability presents a clear risk to the integrity of authentication workflows within HashiCorp Vault. Organizations should prioritize the application of the provided security patches to eliminate the possibility of token leakage. Verify your current Vault configuration to determine if Authorization header pass-through is in use and apply the update immediately to maintain a secure posture.