CVE-2024-2660
Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses
Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses
Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.
- Record
CVE-2024-2660- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-636
- Updated
- 2026-11-02
EUVDEUVD-2024-1224
Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.
- Record
EUVD-2024-1224- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j2rp-gmqv-frhv
HashiCorpVault does not correctly validate OCSP responses
Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. Fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.
- Record
GHSA-j2rp-gmqv-frhv- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-636, CWE-703
- Updated
- 2026-11-02
NVD
Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.
- Record
CVE-2024-2660- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-636
- Updated
- 2026-11-02
OSV
Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses
Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.
- Record
CVE-2024-2660- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-636
- Updated
- 2026-11-02
OSVGHSA-j2rp-gmqv-frhv
HashiCorpVault does not correctly validate OCSP responses
Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. Fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.
- Record
GHSA-j2rp-gmqv-frhv- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-636, CWE-703
- Updated
- 2026-11-02
OSVBIT-vault-2024-2660 No score
Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses
Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.
- Record
BIT-vault-2024-2660- Updated
- 2026-11-02
OSVGO-2024-2690 No score
HashiCorpVault does not correctly validate OCSP responses in github.com/hashicorp/vault
HashiCorpVault does not correctly validate OCSP responses in github.com/hashicorp/vault
- Record
GO-2024-2690- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14104-1 No score
sops-3.9.0-1.1 on GA media
These are all security issues fixed in the sops-3.9.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14104-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/hashicorp/vaultGo |
before 1.16.0 | 1.16.0 |
vaultBitnami |
1.14.0 up to 1.16.0 | 1.16.0 |
sopsopenSUSE:Tumbleweed |
before 3.9.0-1.1 | 3.9.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-2660 is a medium vulnerability (CVSS 6.4) in Hashicorp Vault, published April 4, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. Fixed in github.com/hashicorp/vault 1.16.0.
References
discuss.hashicorp.com/t/hcsec-2024-07-vault-tls-cert-auth-method-did-not-correctly-validate-ocsp-responses/64573
security.netapp.com/advisory/ntap-20240524-0007
nvd.nist.gov/vuln/detail/CVE-2024-2660
github.com/advisories/GHSA-j2rp-gmqv-frhv
suse.com/security/cve/CVE-2024-2660