Infrastructure
HashiCorp Vault: supported versions, open vulnerabilities and status today
HashiCorp Vault 2.1 is supported; 2.0 reached end of life on Aug 31, 2026; the latest release is 2.1.2. 5 high or critical advisories for HashiCorp Vault were published in the last 12 months; none of its advisories is on CISA’s list of exploited vulnerabilities. HashiCorp Vault Status shows no open incidents right now.
Last checked against endoflife.date, OSV.dev, CISA KEV, FIRST EPSS, HashiCorp Vault Status and deps.dev.
- Latest release
- 2.1.2
- GitHub stars
- 36.4k
- OpenSSF Scorecard
- 6.5 / 10
Supported versions
Security advisories
6 advisories published in the last 12 months, 5 of them high or critical. 55 in total since records began. Checked packages: github.com/hashicorp/vault.
HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization
No fixed version listed yet.
EPSS: top 54%HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations
No fixed version listed yet.
EPSS: top 41%HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service
No fixed version listed yet.
EPSS: top 59%HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass
Fixed in 1.21.0.
EPSS: top 60%Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON
Fixed in 1.21.0.
EPSS: top 57%
Status now
No open incidents or maintenance right now.
16 incidents in the last 90 days (9 major). Most recent major: “Terraform Runs Failing” (2026-10-13). Consider retries, timeouts and a fallback path for this dependency. Not counted: 3 notices marked no impact.
Licence
HashiCorp Vault is source-available (BUSL 1.1) since 1.15
HashiCorp moved from MPL 2.0 to the Business Source License 1.1 in August 2023. Running it for your own infrastructure is allowed; offering a competing hosted or embedded product is not.
Maintenance and supply chain
OpenSSF Scorecard 6.5 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 0 issue updates found in the last 90 days.
Weakest checks
- Little code review (Code-Review 0/10)
- Over-privileged CI tokens (Token-Permissions 0/10)
- No static analysis (SAST 0/10)
Docs and release notes
Check HashiCorp Vault in your own stack
This page checks HashiCorp Vault in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.