CVE-2023-5077

Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets

7.6 HighFix available

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: High
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.51%Up 0.5 points since Sep 29, 2023

What each source reports

CVE List Score used 7.6

Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.

Record: CVE-2023-5077
CVSS 3.1: 7.6 HighCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Weakness: CWE-266
Updated: 2026-11-02

EUVDEUVD-2023-2463 7.6

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.

Record: EUVD-2023-2463
CVSS 3.1: 7.6 HighCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-86c6-3g63-5w64 7.6

Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.

Record: GHSA-86c6-3g63-5w64
CVSS 3.1: 7.6 HighCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Weakness: CWE-266, CWE-732
Updated: 2026-11-02

NVD 7.6

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.

Record: CVE-2023-5077
CVSS 3.1: 7.6 HighCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-266, CWE-732
Updated: 2026-11-02

OSV 7.6

Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.

Record: CVE-2023-5077
CVSS 3.1: 7.6 HighCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Weakness: CWE-266
Updated: 2026-11-02

OSVGHSA-86c6-3g63-5w64 7.6

Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.

Record: GHSA-86c6-3g63-5w64
CVSS 3.1: 7.6 HighCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Weakness: CWE-266, CWE-732
Updated: 2026-11-02

OSVBIT-vault-2023-5077 No score

Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.

Record: BIT-vault-2023-5077
Updated: 2026-11-02

OSVGO-2023-2088 No score

Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability in github.com/hashicorp/vault

Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability in github.com/hashicorp/vault

Record: GO-2023-2088
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/hashicorp/vault` Go	before 1.13.0	1.13.0
`vault` Bitnami	0.10.0 up to 1.13.0	1.13.0

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-5077 is a high vulnerability (CVSS 7.6) in Hashicorp Vault, published September 28, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. Fixed in github.com/hashicorp/vault 1.13.0.

Attack profile

How easy it is to exploit

What an attacker can affect

Exploit likelihood

What each source reports

Affected products

Affected packages

History

In short

References