Skip to content
Sign in
6.8 Medium

CVE-2023-4680 HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even…

Description

HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.

Affected products and versions

Product Affected versions Fixed in
Vault 1.14 1.14.0 → < 1.14.3 1.14.3
Vault 1.13 1.13.0 → < 1.13.7 1.13.7
Vault 1.12 1.12.0 → < 1.12.11 1.12.11
Vault 1.6 1.6.0 → < 1.12.0 1.12.0
Vault Enterprise 1.14 1.14.0 → < 1.14.3 1.14.3
Vault Enterprise 1.13 1.13.0 → < 1.13.7 1.13.7
Vault Enterprise 1.12 1.12.0 → < 1.12.11 1.12.11
Vault Enterprise 1.6 1.6.0 → < 1.12.0 1.12.0
vault_enterprise 1.14 1.14.0 → < 1.14.3 1.14.3
Show the 3 other branches
Product Affected versions Fixed in
vault_enterprise 1.13 1.13.0 → < 1.13.7 1.13.7
vault_enterprise 1.12 1.12.0 → < 1.12.11 1.12.11
vault_enterprise 1.6 1.6.0 → < 1.12.0 1.12.0

Other CVEs of Vault

The 43 CVEs of Vault →
CVE-2026-89322 Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and… 7.2 High CVE-2026-105816 Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within… 8.0 High CVE-2026-105818 Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when… 5.9 Medium CVE-2026-5006 A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may… 6.8 Medium
Track this CVE