Servers and applications
CVE-2018-19786
HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autoseal mechanism without an error being reported.
- Severity
- High 8.1
- Published
- 5 Dec 2018
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 1.0.0
- Exploit chance
- 0.9% in the next 30 daysHigher than 61% of CVEs. EPSS by FIRST, 10 Nov 2026
- Attack
- Over the network · Only under certain conditions · No login needed · No user action needed
- Attacker can
- Read data · Change data · Take it down
- CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
HashiCorp VaultServers and applications · cpe:a:hashicorp:vault |
|