HashiCorp Vault is vulnerable to a denial of service attack that allows an unauthenticated attacker to block critical administrative workflows, including root token generation and rekeying operations.

The vulnerability stems from an improper resource management flaw (CWE-770) where an unauthenticated attacker can occupy the single available in-progress operation slot. By repeatedly triggering or canceling specific administrative processes, the attacker prevents legitimate operators from performing sensitive maintenance tasks.

The ability for an unauthenticated user to halt critical security workflows poses a significant operational risk to organizations relying on Vault for secret management. Because this issue prevents root token generation and rekeying, it could hinder disaster recovery efforts or emergency administrative access. With a CVSS score of 7.5, this vulnerability is categorized as High, reflecting the potential for severe disruption to core infrastructure availability.

Immediate Action: Upgrade to Vault Community Edition 2.0.0 or Vault Enterprise 2.0.0 immediately to resolve this resource exhaustion flaw.

Proactive Monitoring: Monitor Vault audit logs for repeated, anomalous initiations or cancellations of root token generation and rekeying requests, which may indicate an attempt to trigger this denial of service condition.

Compensating Controls: Implement network-level access controls to restrict access to the Vault API to known, trusted management segments, thereby limiting the ability of external unauthenticated actors to reach the vulnerable endpoints.

Public Exploit Available: Unknown

Given the ease with which this vulnerability can be exploited by an unauthenticated attacker, it represents a clear and present risk to service continuity. Security teams should prioritize the upgrade to version 2.0.0 across all environments. Failure to patch may leave critical administrative workflows susceptible to intentional disruption by unauthorized actors.