v2.0.3
2026-06-27T08:52:12Z•2c7491a453f7591f00e465a4ea27bcff4df2e335ca6865c20b50105d8993d0e8
acl-bypassai-agentauth-bypassdependency-upgradeenterprisehashicorp-vaultreleasersa-key-size-limitsecuritytemplate-escapingtiming-attackv2.0.0v2.0.1v2.0.2v2.0.3
What happened
HashiCorp Vault 2.0.x release series includes multiple security hardenings and fixes across core, auth backends, and plugins. Notable security fixes: corrected an ACL LIST trailing-slash bypass that could allow skipping more-specific deny policies; changed recovery token comparison to constant-time to mitigate timing attacks; fixed authentication caching issues that could allow AWS auth bypass; and applied dependency/security fixes that address several CVEs. Releases also introduce a limit on RSA SSH key sizes (max 8192 bits) and multiple dependency upgrades (go-jose, cloudflare/circl, opente-
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- hashicorp_vault_releases
- Record identifier
- 2c7491a453f7591f00e465a4ea27bcff4df2e335ca6865c20b50105d8993d0e8
- Enrichment time
- 2026-06-27T08:52:12Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.