CVE-2024-9180 Overview
CVE-2024-9180 is a privilege escalation vulnerability affecting HashiCorp Vault and OpenBao. A privileged Vault operator with write permissions to the root namespace's identity endpoint can escalate their own privileges, or those of another user, to Vault's root policy. The flaw is categorized under [CWE-266] Incorrect Privilege Assignment.
HashiCorp disclosed the issue in advisory HCSEC-2024-21 and shipped fixes in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16. OpenBao, the community fork, is also affected.
Critical Impact
An operator with identity endpoint write access can grant themselves Vault root policy, gaining unrestricted control over secrets, policies, and authentication backends.
Affected Products
- HashiCorp Vault Community Edition prior to 1.18.0
- HashiCorp Vault Enterprise prior to 1.18.0, 1.17.7, 1.16.11, and 1.15.16
- OpenBao (community fork sharing the affected identity subsystem)
Discovery Timeline
- 2024-10-10 - CVE-2024-9180 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-9180
Vulnerability Analysis
Vault's identity system manages entities, entity aliases, and groups that map external authentication identities to internal Vault policies. The identity endpoint in the root namespace performs privileged operations, including binding policies to entities and groups. The vulnerability stems from insufficient policy validation when a privileged operator writes to this endpoint.
A user holding write permissions on identity/* in the root namespace can associate the built-in root policy with an entity or group. Vault normally reserves the root policy for token creation via the root token or approved recovery workflows. By assigning the policy through the identity subsystem, the operator bypasses this constraint and elevates any linked token to root-equivalent authority.
The result is full compromise of the Vault cluster. An attacker with root policy can read every secret, rotate encryption keys, disable audit devices, and reconfigure authentication methods without further checks.
Root Cause
The root cause is missing enforcement that prevents identity endpoint writes from referencing the root policy. The identity subsystem trusted the caller's existing policy set rather than blocking assignment of a policy that grants unrestricted access. This is a classic incorrect privilege assignment weakness [CWE-266].
Attack Vector
Exploitation requires network access to the Vault API and a token that already carries write permissions on the root namespace identity endpoint. The attacker submits an API request to create or update an entity, group, or alias with the root policy attached. Any token subsequently associated with that identity inherits root privileges.
See the HashiCorp Security Advisory HCSEC-2024-21 for vendor-supplied technical details.
Detection Methods for CVE-2024-9180
Indicators of Compromise
- Audit log entries showing PUT or POST requests to identity/entity, identity/group, or identity/entity-alias where the policies field contains root.
- Unexpected token creations that resolve to the root policy through entity or group membership rather than direct root token issuance.
- New or modified identity entities correlated with tokens that later perform sensitive operations such as sys/audit disable or sys/seal.
Detection Strategies
- Enable and centralize Vault audit device logs, then alert on any identity endpoint write that includes the root policy string.
- Baseline legitimate identity administration activity and flag deviations, especially outside change windows.
- Correlate token issuance events with the entity policy set to identify tokens that gained root through indirect assignment.
Monitoring Recommendations
- Ship Vault audit logs to a SIEM and retain them long enough to support historical review of identity mutations.
- Monitor for privilege drift by periodically enumerating entities and groups bound to the root policy.
- Alert on administrative API calls originating from tokens or source IPs outside approved operator inventories.
How to Mitigate CVE-2024-9180
Immediate Actions Required
- Upgrade to Vault Community Edition 1.18.0, or Vault Enterprise 1.18.0, 1.17.7, 1.16.11, or 1.15.16 as appropriate for your release train.
- Review all policies granting write access to identity/* in the root namespace and revoke access where not strictly required.
- Audit existing entities, groups, and aliases for unauthorized root policy assignments and remove any that are illegitimate.
Patch Information
HashiCorp shipped fixes in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16. OpenBao users should track upstream OpenBao releases that incorporate the same fix. Refer to the HashiCorp Security Advisory HCSEC-2024-21 for release-specific guidance.
Workarounds
- Restrict root namespace identity endpoint write permissions to a minimal set of trusted operators enforced through least-privilege policies.
- Require multi-party approval or break-glass procedures for changes to identity entities and groups until patches are applied.
- Rotate any operator credentials that previously held broad identity/* write permissions to invalidate potentially abused tokens.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
