CVE-2024-9180

CVE-2024-9180 is a high-severity privilege escalation vulnerability affecting HashiCorp Vault and OpenBao, allowing a privileged operator with write access to the root namespace’s identity endpoint to escalate their own or another user’s privileges to Vault’s root policy. The CVSS score of 7.2 indicates a high impact on confidentiality, integrity, and availability, with a network attack vector and low attack complexity, requiring high privileges. While the vulnerability has a high risk score and significant potential impact, there is currently no evidence of active exploitation, public exploit code, or community discussion surrounding it. Organizations are advised to update to Vault Community Edition 1.18.0 or Vault Enterprise 1.18.0, 1.17.7, 1.16.11, or 1.15.16 to remediate this flaw.