Critical RCE vulnerability chain affects HashiCorp Vault and OpenBao
Researchers identified an unauthenticated remote code execution exploit impacting HashiCorp Vault and OpenBao, with patches currently available only for OpenBao users.
ControlPlane security researchers found an unauthenticated remote code execution vulnerability chain affecting HashiCorp Vault and OpenBao.
By chaining four distinct vulnerabilities together, an attacker with an unauthenticated entry path and a specific Raft snapshot policy can achieve a full server compromise. This represents only the second known instance of an RCE vulnerability in the Vault codebase.
OpenBao developers patched the flaw in versions 2.6.3 and 2.7.0. You need to update immediately.
Meanwhile, HashiCorp Vault users remain exposed. Due to a lack of coordinated disclosure between stakeholders, no official patch or mitigation strategy currently exists for HashiCorp Vault. You should monitor for updates and implement additional network controls to restrict access to server entry paths.
The exploit path works in real-world production environments where internal infrastructure faces network requests. Since the attack leverages existing administrative policies for Raft snapshots, the impact includes total system takeover and the complete loss of control over stored secrets.