---
id: 8629
title: "[CVE-2020-16250] Enter the Vault: Authentication Issues in HashiCorp Vault"
cve: CVE-2020-16250
source_domain: projectzero.google
source_url: "https://projectzero.google/2020/10/enter-the-vault-auth-issues-hashicorp-vault.html"
published_at: "2020-10-06T00:00:00Z"
tags: ["cloud", "aws", "authentication", "cve", "project-zero", "hashicorp-vault"]
phying_url: "https://phying.com/item/8629"
lang: en
---

# [CVE-2020-16250] Enter the Vault: Authentication Issues in HashiCorp Vault

## Summary

In this blog post I'll discuss two vulnerabilities in HashiCorp Vault and its integration with Amazon Web Services (AWS) and Google Cloud Platform (GCP). These issues can lead to an authentication bypass in configurations that use the aws and gcp auth methods, and demonstrate the type of issues you can find in modern “cloud-native” software. Both vulnerabilities (CVE-2020-16250/16251) were addressed by HashiCorp and are fixed in Vault versions 1.2.5, 1.3.8, 1.4.4 and 1.5.1 released in August.

## Intelligence Metadata

- **Sources:** projectzero.google
- **CVE:** CVE-2020-16250
- **Published:** 2020-10-06T00:00:00Z
- **Original:** https://projectzero.google/2020/10/enter-the-vault-auth-issues-hashicorp-vault.html
- **Phying News:** https://phying.com/item/8629