Authorization Bypass

github.com/hashicorp/terraform-provider-vault is vulnerable to authorization bypass. The insecure configuration in GCE-type bound labels for GCP auth method could allow for an attacker to bypass authorization and access otherwise restricted actions...

CVE-2021-30476

HashiCorp Terraform’s Vault Provider terraform-provider-vault did not correctly configure GCE-type bound labels for Vault’s GCP auth method. Fixed in 2.19.1...

Terraform’s Vault Provider Did Not Correctly Configure Bound Labels for GCP Auth

Summary Terraform’s Vault Provider terraform-provider-vault did not correctly configure GCE-type bound labels for Vault’s GCP auth method. This vulnerability, CVE-2021-30476, was fixed in terraform-provider-vault 2.19.1. Background Terraform’s Vault Provider...