Medium severity5.5NVD Advisory· Published Apr 30, 2024· Updated Jun 17, 2026

CVE-2024-2877

Description

Vault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log request headers on the standby node. These logs may have included sensitive HTTP request information in cleartext.

This vulnerability, CVE-2024-2877, was fixed in Vault Enterprise 1.15.8.

Affected products

Hashicorp/Vault Enterprisecpe-rescue2 versions
1.15.0+ 1 more
- (no CPE)range: 1.15.0
- (no CPE)range: before 1.15.8
Hashicorp/Vault
cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*
Range: >=1.15.0,<1.15.8
osv-coords
pkg:bitnami/vault
Range: >= 1.15.0, < 1.15.8

Patches

Vulnerability mechanics

References

security.netapp.com/advisory/ntap-20240614-0002/nvdThird Party Advisory
discuss.hashicorp.com/t/hsec-2024-10-vault-enterprise-leaks-sensitive-http-request-headers-in-audit-log-when-deployed-with-a-performance-standby-nodenvdBroken Link

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000