CVE-2022-36129
HashiCorp Vault and Vault Enterprise through 2022-07-17 have Incorrect Access Control.
HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. Fixed in Vault Enterprise 1.9.8, 1.10.5, and 1.11.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. Fixed in Vault Enterprise 1.9.8, 1.10.5, and 1.11.1.
- Record
CVE-2022-36129- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-306
- Updated
- 2026-11-02
CVE List No score
HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. Fixed in Vault Enterprise 1.9.8, 1.10.5, and 1.11.1.
- Record
CVE-2022-36129- Updated
- 2026-11-02
EUVDEUVD-2022-38850 No score
HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. Fixed in Vault Enterprise 1.9.8, 1.10.5, and 1.11.1.
- Record
EUVD-2022-38850- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c8mv-ccvj-9h5q
HashiCorp Vault and Vault Enterprise through 2022-07-17 have Incorrect Access Control.
HashiCorp Vault and Vault Enterprise through 2022-07-17 have Incorrect Access Control.
- Record
GHSA-c8mv-ccvj-9h5q- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVBIT-vault-2022-36129 No score
HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. Fixed in Vault Enterprise 1.9.8, 1.10.5, and 1.11.1.
- Record
BIT-vault-2022-36129- Updated
- 2026-11-02
OSV No score
HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. Fixed in Vault Enterprise 1.9.8, 1.10.5, and 1.11.1.
- Record
CVE-2022-36129- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vaultBitnami |
1.7.0 up to 1.9.8, 1.10.0 up to 1.10.5, 1.11.0 up to 1.11.1 | 1.9.81.10.51.11.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-36129 is a critical vulnerability (CVSS 9.1) in Hashicorp Vault, published July 26, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.63%, the 76th percentile. Fixed in vault 1.9.8.
References
discuss.hashicorp.com
security.netapp.com/advisory/ntap-20220901-0011
nvd.nist.gov/vuln/detail/CVE-2022-36129
github.com/advisories/GHSA-c8mv-ccvj-9h5q