Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2023-5077

22
FAUCET Score

CVE-2023-5077 describes a vulnerability in HashiCorp Vault and Vault Enterprise's Google Cloud secrets engine, where existing Google Cloud IAM Conditions were not preserved when creating or updating rolesets. This flaw has a CVSS score of 7.5 (HIGH), indicating a network-exploitable vulnerability with low attack complexity that could lead to high integrity impact, allowing unauthorized modifications. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE. The issue was resolved in Vault version 1.13.0.

Impacted Technologies

VendorProductVersion(s)CPE
>= 0.10.0, < 1.13.0CPE matchmatch criteria
cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*
>= 0.10.0, < 1.13.0CPE matchmatch criteria
cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.6HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
1.0
Impact Score
6.0
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.44%
Probability of exploitation in next 30 days
EPSS Percentile
35.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0044 is in the 15th percentile among its peer group of 51,553 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (4)

gopatch availablevia ghsa
Product: github.com/hashicorp/vaultFixed in: 1.13.0
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.17Fixed in: openshift4/ose-installer-rhel9:v4.17.0-202409122204.p0.gdfd4c08.assembly.stream.el9
View patch
redhatpatch availablevia redhat_api
Product: RHODF-4.14-RHEL-9Fixed in: odf4/odf-rhel9-operator:v4.14.0-18
View patch
redhatno patchvia redhat_api
Product: Red Hat Openshift Data Foundation 4Fixed in: odf4/mcg-rhel9-operator

Vendor Advisories (2)

goGHSA-86c6-3g63-5w64high

Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability

Sep 29, 2023
redhatCVE-2023-5077Moderate

hashicorp/vault: Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets

Sep 29, 2023

References

discuss.hashicorp.com / t/hcsec-2023-30-vault-s-google-cloud-secrets-engine-removed-existing-iam-conditions-when-creating-updating-rolesets/58654
Vendor Advisory