vault: Token leases incorrectly treated as non-expiring (CVE-2021-32923)

Overview

A flaw was found in the HashiCorp Vault and Vault Enterprise. The vault could allow a remote attacker to bypass security restrictions caused by a renewal logic flaw when a token lease or dynamic secret lease was renewed inside the last second of its maximum TTL. By sending a specially crafted request, an attacker can bypass authentication validation and gain access to the system.

Vendor advisories

• Red Hat VEX · Moderate · affected: Red Hat Openshift Container Storage 4 · updated 2026-09-17 · vex

vault: Token leases incorrectly treated as non-expiring — rated Moderate by Red Hat. Released 2021-06-03, updated 2026-09-17.

Affected:

• Red Hat Openshift Container Storage 4

Not affected:

• Logging Subsystem for Red Hat OpenShift
• OpenShift Service Mesh 2.0
• Red Hat Advanced Cluster Management for Kubernetes 2
• Red Hat OpenShift Container Platform 4
• Red Hat Openshift Data Foundation 4

Remediation

Refer to the advisory for fix availability.

Package advisory (CVE-2021-32923)

Affected packages:

• github.com/hashicorp/vault >= 1.7.0, < 1.7.2
• github.com/hashicorp/vault >= 1.6.0, < 1.6.5
• github.com/hashicorp/vault >= 0.10.0, < 1.5.9

Patched in:

• github.com/hashicorp/vault 1.7.2
• github.com/hashicorp/vault 1.6.5
• github.com/hashicorp/vault 1.5.9

Source: https://osv.dev/vulnerability/GHSA-38j9-7pp9-2hjw