Security readout for executives and security teams
Plain-English summary
Some HashiCorp Vault Enterprise disaster recovery secondaries could reveal license metadata to unauthenticated users. The sources describe exposure of license metadata, not Vault secrets. The issue affects Vault Enterprise 0.9.2 through 1.6.2 and was fixed in 1.6.3.
Executive priority
Handle during normal vulnerability remediation unless DR secondaries are internet-exposed or accessible to untrusted parties. The business impact appears limited to license metadata disclosure based on provided evidence.
Technical view
CVE-2021-27668 is an unauthenticated information disclosure issue in Vault Enterprise DR secondaries. Affected versions are 0.9.2 through 1.6.2. The disclosed data is license metadata. The provided sources do not include CVSS, CWE, exploit details, or evidence of compromise.
Likely exposure
Exposure is most likely where Vault Enterprise 0.9.2 through 1.6.2 is used with DR secondary nodes reachable by untrusted networks or users.
Exploitation context
The CVE is not listed as KEV in the provided bundle, and the cited sources do not claim active exploitation. Treat this as confirmed unauthenticated metadata exposure, not evidence of secret theft.
Researcher notes
The record lacks CVSS, CWE, and detailed affected CPE data. Analysis should stay bounded to Vault Enterprise DR secondaries and license metadata disclosure unless vendor advisories or environment evidence show broader impact.
Mitigation direction
- Upgrade affected Vault Enterprise deployments to 1.6.3 or later.
- Review HashiCorp HCSEC-2021-05 for vendor-specific guidance.
- Restrict access to Vault DR secondary endpoints to trusted networks.
- Confirm package updates where Vault is managed through downstream distributions.
Validation and detection
- Inventory Vault Enterprise versions across primary and DR secondary nodes.
- Identify any DR secondary endpoints reachable from untrusted networks.
- Confirm unauthenticated users cannot access license metadata after remediation.
- Review monitoring logs for unexpected unauthenticated requests to DR secondaries.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-27668 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://discuss.hashicorp.com/t/hcsec-2021-05-vault-enterprise-s-dr-secondaries-exposed-license-metadata-without-authentication/21427CVE reference · x_refsource_MISC
- GLSA-202207-01CVE reference · vendor-advisory, x_refsource_GENTOO
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.