CVE-2021-32923

Vulnerability

HashiCorp Vault and Vault Enterprise from version 0.10.0 through 1.7.1 contained a logic flaw in lease renewal. When a token lease or dynamic secret lease was renewed within the last second of its maximum TTL, the renewed lease was assigned a TTL of zero seconds (rounded down). This zero-second TTL was incorrectly interpreted as non-expiring by Vault’s internal accounting, allowing the lease to be used indefinitely [1][2].

Exploitation

To exploit this issue, an attacker must possess an existing valid Vault token. The vulnerability is triggered when a lease is renewed inside a narrow time window (the final second of its maximum TTL). Automation-driven renewals operating with tight time tolerances are more likely to hit this window. No additional authentication or network position beyond that required for normal lease renewal is needed [2].

Impact

Successfully exploited leases – both token leases and dynamic secret leases – are never revoked. This means tokens or dynamic secrets that should have expired remain valid indefinitely, potentially granting continued access to resources that were intended to be time-limited. The impact is a violation of the intended time-to-live policy, leading to unauthorized access or privilege persistence [2].

Mitigation

The vulnerability is fixed in Vault and Vault Enterprise versions 1.5.9, 1.6.5, and 1.7.2. Operators should upgrade to one of these releases or later. No workaround is known [2][3].