HashiCorp Vault Vulnerability Allow Attackers to Authenticate to Vault Without Valid Credentials

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical HashiCorp Vault Vulnerability Enables Authentication Bypass A critical authentication bypass vulnerability has been identified in HashiCorp's Vault Terraform Provider, affecting versions v4.2.0 and later. This flaw allows attackers to authenticate to Vault without valid credentials, posing significant security risks to users of the affected software. 2 sources 21