# HCSEC-2024-05 - Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates

**URL:** <https://discuss.hashicorp.com/t/hcsec-2024-05-vault-cert-auth-method-did-not-correctly-validate-non-ca-certificates/63382>\
**Category:** Security\
**Tags:** security-vault\
**Created:** [March 4, 2024, 7:10pm UTC](https://discuss.hashicorp.com/t/hcsec-2024-05-vault-cert-auth-method-did-not-correctly-validate-non-ca-certificates/63382 "2024-03-04T19:10:36Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![eastebry](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/eastebry/32/13616_2.png) [@eastebry](https://discuss.hashicorp.com/u/eastebry)\
**Post date:** [March 4, 2024, 7:10pm UTC](https://discuss.hashicorp.com/t/hcsec-2024-05-vault-cert-auth-method-did-not-correctly-validate-non-ca-certificates/63382/1 "2024-03-04T19:10:36Z")

</div>

**Bulletin ID:** HCSEC-2024-05  
**Affected Products / Versions:** Vault and Vault Enterprise up to 1.15.4, 1.14.9; fixed in 1.15.5 and 1.14.10.  
**Publication Date:** March 4, 2024

**Summary**  
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [trusted certificate](https://developer.hashicorp.com/vault/api-docs/auth/cert#certificate). In this configuration, an attacker may be able to craft a malicious certificate that could be used to bypass authentication. This vulnerability, CVE-2024-2048, is fixed in Vault 1.15.5 and 1.14.10.

**Background**  
Vault offers a wide range of [auth methods](https://developer.hashicorp.com/vault/api-docs/auth) for authentication, including [TLS client certificates](https://developer.hashicorp.com/vault/api-docs/auth/cert). Vault’s TLS auth method supports trusted certificates signed by certificate authorities as well as non-CA signed certificates.

**Details**  
Vault relies on Golang’s TLS libraries to validate client certificates, in combination with further checks in Vault’s code. It was discovered that in the case of non-CA signed trusted certificates, Vault insufficiently validated this certificate. As a result, this attacker could use a maliciously crafted certificate to bypass authentication, should the attacker have out-of-band access to information about this public trusted certificate.

**Remediation**  
Customers using the TLS auth method with a non-CA certificate as a trusted certificate in their Vault installation should evaluate the risk associated with this issue and consider upgrading to Vault Enterprise 1.15.5, 1.14.10, or newer. Please refer to [Upgrading Vault](https://learn.hashicorp.com/tutorials/vault/sop-upgrade?in=vault/standard-procedures) for general guidance and version-specific upgrade notes.

**Acknowledgement**  
This issue was identified by Nathanial “d0nut” Lattimer who reported it to HashiCorp.

_We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see [https://hashicorp.com/security](https://hashicorp.com/security)._