Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-bfm3-2zvj-5bca
Vulnerability ID VCID-bfm3-2zvj-5bca
Aliases CVE-2021-42135
GHSA-362v-wg5p-64w2
Summary Incorrect Privilege Assignment in HashiCorp Vault HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have more privileges than intended, e.g., a user with read permission for the /gcp/roleset/* path may be able to issue Google Cloud service account credentials.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-266 Incorrect Privilege Assignment
CWE-863 Incorrect Authorization
System Score Found at
cvssv3 8.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-42135.json
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-42135
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-42135
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-42135
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-42135
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-42135
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-42135
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-42135
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-42135
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-42135
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-42135
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-42135
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-42135
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-42135
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-42135
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-42135
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-42135
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-42135
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2021-42135
cvssv3.1 8.1 https://discuss.hashicorp.com/t/hcsec-2021-28-vaults-google-cloud-secrets-engine-policies-with-globs-may-provide-additional-privileges-in-vault-1-8-0-onwards
generic_textual HIGH https://discuss.hashicorp.com/t/hcsec-2021-28-vaults-google-cloud-secrets-engine-policies-with-globs-may-provide-additional-privileges-in-vault-1-8-0-onwards
cvssv3.1 8.1 https://github.com/hashicorp/vault
generic_textual HIGH https://github.com/hashicorp/vault
cvssv3.1 8.1 https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#180
generic_textual HIGH https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#180
cvssv3.1 8.1 https://nvd.nist.gov/vuln/detail/CVE-2021-42135
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2021-42135
archlinux Medium https://security.archlinux.org/AVG-2457
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-42135.json
https://api.first.org/data/v1/epss?cve=CVE-2021-42135
https://discuss.hashicorp.com/t/hcsec-2021-28-vaults-google-cloud-secrets-engine-policies-with-globs-may-provide-additional-privileges-in-vault-1-8-0-onwards
https://github.com/hashicorp/vault
https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#180
https://nvd.nist.gov/vuln/detail/CVE-2021-42135
2015885 https://bugzilla.redhat.com/show_bug.cgi?id=2015885
AVG-2457 https://security.archlinux.org/AVG-2457
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-42135.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://discuss.hashicorp.com/t/hcsec-2021-28-vaults-google-cloud-secrets-engine-policies-with-globs-may-provide-additional-privileges-in-vault-1-8-0-onwards
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/hashicorp/vault
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#180
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-42135
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.4011
EPSS Score 0.00185
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:00:38.260157+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-362v-wg5p-64w2/GHSA-362v-wg5p-64w2.json 38.0.0