CVE-2024-5798

highpriority · track · 30EPSS 0.003 · 28 %ileDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.34% (28th) EPSS

CVSS 7.5 · high

Is it mine?

12 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected. This vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0, 1.16.3, and 1.15.9

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 2.6–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.12.6lowCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:Nsecondary · ENISA EU

v3.12.6lowCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:Nsecondary · security@hashicorp.comexploitability 1 · impact 1.4

v3.12.6lowCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:Nsecondary · OSV

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-285USCWE-287USCWE-287US

affected products (12)

Products and version ranges known to be affected.

Hashicorp Vault0.11.0 → 1.16.2enisa_euvdEU
Hashicorp Vault Enterprise0.11.0 → 1.16.2enisa_euvdEU
Hashicorp Vault0.11.0 → 1.15.9fstec_bduRU
Hashicorp Vault1.16.0 → 1.16.3fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
hashicorp vault0.11.0 → 1.15.9nvdUScpe:2.3:a:hashicorp:vault:*:*:*:*:*:*:*:*
hashicorp vault1.16.0 → 1.16.3nvdUScpe:2.3:a:hashicorp:vault:*:*:*:*:*:*:*:*
Bitnami vault0.11.0 → 1.16.2osvUSpkg:bitnami/vault
Go github.com/hashicorp/vault0.11.0 → 1.15.9osvUSpkg:golang/github.com/hashicorp/vault
Go github.com/hashicorp/vault0.11.0 → 1.16.3osvUSpkg:golang/github.com/hashicorp/vault
Go github.com/hashicorp/vault1.16.0-rc1 → 1.16.3osvUSpkg:golang/github.com/hashicorp/vault
Go github.com/hashicorp/vault1.17.0-rc1 → 1.17.0osvUSpkg:golang/github.com/hashicorp/vault

advisories (4)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-1365Hashicorp Vault: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2024-06-12csaf · cert_bundDE
Ein entfernter Angreifer mit hohen Privilegien kann eine Schwachstelle in Hashicorp Vault ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
GHSA-32cj-5wx4-gq8pHashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims2024-06-12ghsa · osvUS
Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected. This vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0, 1.16.3, and 1.15.9
BIT-vault-2024-5798Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims2024-06-17vendor · osvUS
Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected. This vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0, 1.16.3, and 1.15.9
GO-2024-2921HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims in github.com/hashicorp/vault2024-07-01vendor · osvUS
HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims in github.com/hashicorp/vault. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/hashicorp/vault before v1.15.9.

also known as (7)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv nvd cert_bund NVD CVE.org MITRE

published 2024-06-12modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan