PT-2024-37162 · Hashicorp+1 · Hashicorp Vault+1

Alex Scheel + 1 · Published 2024-06-12 · Updated 2025-08-28 · CVE-2024-5798

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault versions prior to 1.15.9 HashiCorp Vault versions prior to 1.16.3 HashiCorp Vault versions prior to 1.17.0

Description: The issue arises from improper validation of the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may result in Vault validating a JWT even when the audience and role-bound claims do not match, allowing an invalid login to succeed.

Recommendations: For versions prior to 1.15.9, update to version 1.15.9 or later. For versions prior to 1.16.3, update to version 1.16.3 or later. For versions prior to 1.17.0, update to version 1.17.0 or later.

Fix

Improper Authorization

Improper Authentication

Weakness Enumeration

CWE-285

CWE-287

Related Identifiers

BDU:2025-10836

BIT-VAULT-2024-5798

CVE-2024-5798

GHSA-32CJ-5WX4-GQ8P

GO-2024-2921

Affected Products

Hashicorp Vault

Red Os

References · 13

• https://osv.dev/vulnerability/CVE-2024-5798 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10836 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-5798 · Security Note
• https://discuss.hashicorp.com/t/hcsec-2024-11-vault-incorrectly-validated-json-web-tokens-jwt-audience-claims/67770 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-32cj-5wx4-gq8p · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2921 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-vault-2024-5798 · Vendor Advisory
• https://github.com/hashicorp/vault · Note
• https://pkg.go.dev/vuln/GO-2024-2921 · Note
• https://redos.red-soft.ru/support/secure · Note
• https://t.me/cvenotify/83061 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-vault-cve-2024-5798 · Note
• https://github.com/advisories/GHSA-32cj-5wx4-gq8p · Note