# HCSEC-2022-12 - Vault’s Login MFA Configuration And Enforcement Not Reloaded After Restart

**URL:** <https://discuss.hashicorp.com/t/hcsec-2022-12-vault-s-login-mfa-configuration-and-enforcement-not-reloaded-after-restart/39565>\
**Category:** Security\
**Tags:** security-vault\
**Created:** [May 16, 2022, 3:42pm UTC](https://discuss.hashicorp.com/t/hcsec-2022-12-vault-s-login-mfa-configuration-and-enforcement-not-reloaded-after-restart/39565 "2022-05-16T15:42:08Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![jfinnigan](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jfinnigan/32/3834_2.png) [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\
**Post date:** [May 16, 2022, 3:42pm UTC](https://discuss.hashicorp.com/t/hcsec-2022-12-vault-s-login-mfa-configuration-and-enforcement-not-reloaded-after-restart/39565/1 "2022-05-16T15:42:08Z")

</div>

**Bulletin ID:** HCSEC-2022-12  
**Affected Products / Versions:** Vault and Vault Enterprise from 1.10.0 through 1.10.2; fixed in 1.10.3.  
**Publication Date:** May 16, 2022

**Summary**  
A vulnerability was identified in Vault and Vault Enterprise (“Vault”) from 1.10.0 to 1.10.2 where MFA may not be enforced on user logins after a server restart. This vulnerability, CVE-2022-30689, was fixed in Vault 1.10.3.

**Background**  
Vault provides a wide range authentication methods, including a recently introduced [Login MFA](https://www.vaultproject.io/docs/auth/login-mfa) feature which allows the use of TOTP passcodes or third party services (Duo, Okta, PingID) as second factors for user authentication on login. Vault also offers [Enterprise MFA](https://www.vaultproject.io/docs/enterprise/mfa), which provides path-based enforcement of MFA in policies.

**Details**  
An external party reported that the configuration and enforcement of the Login MFA feature was not being loaded after a Vault restart.

This vulnerability affects the Login MFA feature introduced in Vault and Vault Enterprise 1.10.0, but does not affect any of Vault’s Enterprise MFA features.

**Remediation**  
Customers should evaluate the risk associated with this issue and consider upgrading to Vault or Vault Enterprise 1.10.3, or newer. Please refer to [Upgrading Vault](https://www.vaultproject.io/docs/upgrading) for general guidance and version-specific upgrade notes.

**Acknowledgement**  
This issue was identified by an external party who reported it to HashiCorp.

_We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see [Security at HashiCorp](https://hashicorp.com/security)._