Skip to content
Heist/ feed
Back to feed
High

Vault Operators in Root Namespace May Elevate Their Privileges

Type: advisorySources: OSV

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2024-9180
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 07:40 UTC · Revision 1

Source evidence

Vault Operators in Root Namespace May Elevate Their Privileges

core-osv · Original source

Published 10 Oct 2024, 20:54 UTC

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16.

osv:CVE-2024-9180
Complete source record
{
  "id": "39107a77b9022dc0599424c3a2a64052a197d492cba13a40b43672235d442732",
  "url": "https://osv.dev/vulnerability/CVE-2024-9180",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Vault Operators in Root Namespace May Elevate Their Privileges",
    "summary": "A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16.",
    "evidence": "osv:CVE-2024-9180",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2024-9180",
      "aliases": [
        "BIT-openbao-2024-9180",
        "BIT-vault-2024-9180",
        "CVE-2024-9180",
        "GHSA-rr8j-7w34-xp5j",
        "GO-2024-3191"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/hashicorp/vault",
              "type": "GIT",
              "events": [
                {
                  "introduced": "e21712a687889de1125e0a12a980420b1a4f72d3"
                },
                {
                  "fixed": "77f26ba561a4b6b1ccd5071b8624cefef7a72e84"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0.10.4"
                      },
                      {
                        "fixed": "1.18.0"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "cpe": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
                    "range": [
                      {
                        "introduced": "1.7.7"
                      },
                      {
                        "fixed": "1.18.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            },
            {
              "repo": "https://github.com/openbao/openbao",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "a2522eb71d1854f83c7e2e02fdbfc01ae74c3a78"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.0.3"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.18.0-rc1",
            "sdk/v0.14.0",
            "api/auth/userpass/v0.8.0",
            "api/auth/ldap/v0.8.0",
            "api/auth/kubernetes/v0.8.0",
            "api/auth/gcp/v0.8.0",
            "api/auth/azure/v0.7.0",
            "api/auth/aws/v0.8.0",
            "api/auth/approle/v0.8.0",
            "api/v1.15.0",
            "sdk/v0.13.0",
            "api/auth/userpass/v0.7.0",
            "api/auth/ldap/v0.7.0",
            "api/auth/kubernetes/v0.7.0",
            "api/auth/gcp/v0.7.0",
            "api/auth/azure/v0.6.0",
            "api/auth/aws/v0.7.0",
            "api/auth/approle/v0.7.0",
            "api/v1.14.0",
            "api/v1.13.0",
            "sdk/v0.12.0",
            "api/v1.12.2",
            "sdk/v0.11.1",
            "api/v1.12.1",
            "api/auth/userpass/v0.6.0",
            "api/auth/ldap/v0.6.0",
            "api/auth/kubernetes/v0.6.0",
            "api/auth/gcp/v0.6.0",
            "api/auth/aws/v0.6.0",
            "api/auth/approle/v0.6.0",
            "sdk/v0.11.0",
            "api/v1.12.0",
            "api/v1.11.0",
            "sdk/v0.10.1",
            "api/auth/userpass/v0.5.0",
            "api/auth/ldap/v0.5.0",
            "api/auth/kubernetes/v0.5.0",
            "api/auth/gcp/v0.5.0",
            "api/auth/azure/v0.5.0",
            "api/auth/aws/v0.5.0",
            "api/auth/approle/v0.5.0",
            "sdk/v0.10.0",
            "api/v1.10.0",
            "sdk/v0.9.2",
            "api/auth/userpass/v0.4.1",
            "api/auth/ldap/v0.4.1",
            "api/auth/kubernetes/v0.4.1",
            "api/auth/gcp/v0.4.1",
            "api/auth/azure/v0.4.1",
            "api/auth/aws/v0.4.1",
            "api/auth/approle/v0.4.1",
            "sdk/v0.9.1",
            "api/v1.9.2",
            "api/v1.9.1",
            "sdk/v0.9.0",
            "api/auth/userpass/v0.4.0",
            "api/auth/ldap/v0.4.0",
            "api/auth/kubernetes/v0.4.0",
            "api/auth/gcp/v0.4.0",
            "api/auth/azure/v0.4.0",
            "api/auth/aws/v0.4.0",
            "api/auth/approle/v0.4.0",
            "sdk/v0.8.0",
            "api/v1.9.0",
            "api/v1.8.3",
            "sdk/v0.7.0",
            "sdk/v0.6.2",
            "sdk/v0.6.1",
            "api/v1.8.2",
            "api/v1.8.1",
            "api/auth/userpass/v0.3.0",
            "api/auth/ldap/v0.3.0",
            "api/auth/kubernetes/v0.3.0",
            "api/auth/gcp/v0.3.0",
            "api/auth/azure/v0.3.0",
            "api/auth/aws/v0.3.0",
            "api/auth/approle/v0.3.0",
            "api/v1.8.0",
            "sdk/v0.6.0",
            "api/auth/userpass/v0.2.0",
            "api/auth/ldap/v0.2.0",
            "api/auth/kubernetes/v0.2.0",
            "api/auth/gcp/v0.2.0",
            "api/auth/azure/v0.2.0",
            "api/auth/aws/v0.2.0",
            "api/auth/approle/v0.2.0",
            "sdk/v0.5.3",
            "api/v1.7.2",
            "sdk/v0.5.1",
            "api/v1.7.1",
            "api/v1.7.0",
            "api/v1.6.0",
            "sdk/v0.5.0",
            "api/v1.5.0",
            "sdk/v0.4.1",
            "last-go-modable",
            "api/auth/ldap/v0.1.0",
            "api/v1.3.1",
            "api/auth/approle/v0.1.1",
            "main-creation",
            "api/auth/gcp/v0.1.0",
            "api/auth/azure/v0.1.0",
            "api/auth/userpass/v0.1.0",
            "api/auth/kubernetes/v0.1.0",
            "api/auth/aws/v0.1.0",
            "api/auth/approle/v0.1.0",
            "sdk/v0.3.0",
            "api/v1.2.0",
            "api/v1.1.1",
            "sdk/v0.2.1",
            "v1.2.0",
            "v1.2.0-rc1",
            "api/v1.0.4",
            "sdk/v0.1.13",
            "api/v1.0.3",
            "sdk/v0.1.12",
            "v1.2.0-beta2",
            "v1.2.0-beta1",
            "sdk/v0.1.11",
            "sdk/v0.1.10",
            "api/v1.0.2",
            "v1.1.1",
            "sdk/v0.1.9",
            "api/v1.0.1",
            "sdk/v0.1.8",
            "v1.1.0",
            "v1.1.0-beta2",
            "v1.1.0-beta1",
            "v1.0.3",
            "v1.0.2",
            "v1.0.1",
            "v1.0.0",
            "v1.0.0-rc1",
            "v1.0.0-beta2",
            "v1.0.0-beta1",
            "v0.11.2",
            "v0.11.1",
            "v0.11.0",
            "v0.11.0-beta1",
            "v0.10.4",
            "v2.0.2",
            "v2.0.1",
            "v2.0.0",
            "v2.0.0-beta20240618",
            "sdk/v1.100.0-development20240408",
            "api/v1.100.0-development20240408",
            "api/auth/userpass/v1.1.0-development20240408",
            "api/auth/ldap/v1.1.0-development20240408",
            "api/auth/kubernetes/v1.1.0-development20240408",
            "api/auth/gcp/v1.1.0-development20240408",
            "api/auth/azure/v1.1.0-development20240408",
            "api/auth/aws/v1.1.0-development20240408",
            "api/auth/approle/v1.1.0-development20240408",
            "v2.0.0-alpha20240329",
            "before-plugin-removal"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-9180.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:26.658893041Z",
      "provider": "osv",
      "references": [
        "https://discuss.hashicorp.com/t/hcsec-2024-21-vault-operators-in-root-namespace-may-elevate-their-privileges/70565",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9180.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2024-9180",
        "https://github.com/hashicorp/vault"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-266"
        ],
        "cna_assigner": "HashiCorp",
        "unresolved_ranges": [
          {
            "extracted_events": [
              {
                "range": [
                  {
                    "introduced": "0.10.4"
                  },
                  {
                    "fixed": "1.17.7"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "ChangesAt"
              }
            ]
          }
        ],
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9180.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2024-9180",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 493457,
  "published_at": "2024-10-10T20:54:57.084+00:00"
}