CVE-2022-40186

A flaw was found in HashiCorp Vault and Vault Enterprise, where they could allow a locally authenticated attacker to gain unauthorized access to the system, caused by a flaw in the alias naming schema implementation for mount accessors with shared alias names in the Identity Engine. By conducting a specially-crafted operation, an attacker can overwrite metadata to the wrong alias, gaining unauthorized access to key/value paths using the metadata in Vault.