Vault Operators in Root Namespace May Elevate Their Privileges (CVE-2024-9180)

CVE-2024-9180 is a privilege escalation vulnerability in Vault where a privileged operator with write permissions to the root namespace’s identity endpoint can escalate privileges to the root policy. This allows unauthorized elevation of access within Vault. The vulnerability affects Vault versions >=1.7.7 and <1.18.0. Official patches have been released in Vault Community Edition 1.18.0 and Vault Enterprise 1.15.16, 1.16.11, 1.17.7, and 1.18.0.

An attacker or malicious operator with write access to the root namespace’s identity endpoint can escalate privileges to Vault’s root policy, potentially gaining full administrative control over Vault. This could lead to unauthorized access to secrets and sensitive operations within Vault.

Apply the official patches provided by Vault: upgrade to Vault Community Edition 1.18.0 or Vault Enterprise versions 1.15.16, 1.16.11, 1.17.7, or 1.18.0. These versions contain fixes for this privilege escalation vulnerability. No alternative mitigations are indicated by the vendor advisory.