Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default (CVE-2024-7594)
Description
Vault's SSH secrets engine had a configuration issue where the valid_principals list was not required to contain a value by default. This could allow an authorized user to request an SSH certificate that authenticates as any user on the host if the valid_principals and default_user fields were not set. The vulnerability affects Vault Community Edition and Enterprise versions prior to 1.17.6 and has been fixed in versions 1.17.6 (Community), 1.17.6, 1.16.10, and 1.15.15 (Enterprise).
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Vault SSH secrets engine did not enforce a requirement for the valid_principals list to contain a value by default. When both valid_principals and default_user fields were unset, an authorized user could obtain an SSH certificate from Vault that allowed authentication as any user on the host. This misconfiguration could lead to unauthorized privilege escalation. The issue has been addressed in Vault Community Edition 1.17.6 and Vault Enterprise versions 1.17.6, 1.16.10, and 1.15.15.
Potential Impact
An authorized user of Vault's SSH secrets engine could exploit this configuration flaw to authenticate as any user on the host, potentially leading to unauthorized access and privilege escalation on affected systems.
Mitigation Recommendations
A patch is available and should be applied. Upgrade to Vault Community Edition 1.17.6 or Vault Enterprise 1.17.6, 1.16.10, or 1.15.15 to remediate this vulnerability. Ensure that the valid_principals and default_user fields are properly configured to restrict SSH certificate authentication to intended users.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-vault-2024-7594
- Osv Schema Version
- 1.5.0
- Aliases
- ["CVE-2024-7594"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- High
Threat ID: 6aa005b1acd9273b49ab5885
Added to database: 09/08/2026, 12:55:13 UTC
Last enriched: 09/08/2026, 13:34:20 UTC
Last updated: 10/23/2026, 15:10:08 UTC
Views: 24
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.