LiveActive security incident?Get immediate response
CVE Record

CVE-2021-32923: HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret...

HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

HashiCorp Vault and Vault Enterprise could incorrectly turn nearly expired token or dynamic secret leases into non-expiring leases. That weakens time-based access control and may leave access alive longer than intended. The issue is fixed in Vault 1.5.9, 1.6.5, and 1.7.2.

Executive priority

Treat this as a priority maintenance fix for Vault environments. It is not documented as actively exploited, but Vault controls sensitive access, so incorrect lease expiration can increase credential exposure.

Technical view

The flaw affects lease renewal when a token lease or dynamic secret lease is within one second of its maximum TTL. A renewal in that edge window could cause later use to treat the lease as non-expiring. Sources do not provide CVSS, CWE, or detailed affected version ranges beyond the fixed releases.

Likely exposure

Exposure is most relevant to organizations running HashiCorp Vault or Vault Enterprise before 1.5.9, 1.6.5, or 1.7.2, especially where token and dynamic secret TTLs are relied on to limit access duration.

Exploitation context

The supplied sources do not show active exploitation, public exploit use, or KEV listing. The risk is operational: access that should expire may persist if the lease renewal edge case occurred.

Researcher notes

Evidence is limited to the CVE description, HashiCorp advisory reference, and Gentoo advisory reference. No CVSS, CWE, exploit status, or complete affected-version matrix is included in the supplied bundle.

Mitigation direction

  • Upgrade Vault or Vault Enterprise to 1.5.9, 1.6.5, 1.7.2, or later.
  • Prioritize Vault clusters managing production credentials or privileged dynamic secrets.
  • Consult HashiCorp guidance for cleanup of suspect leases or tokens.
  • Do not deploy directly without completing your standard Vault change-control testing.

Validation and detection

  • Identify all Vault and Vault Enterprise versions in use.
  • Check whether deployments predate the fixed releases.
  • Review lease and token inventories for unexpectedly non-expiring entries.
  • Confirm upgrade status across primary and standby Vault nodes.
  • Document any cleanup decisions based on vendor guidance.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-32923 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.