Skip to content
THREATWIRE

HashiCorp Vault

Secrets management and encryption as a service

Secrets manager that stores and issues credentials, certificates and keys, with dynamic secrets, encryption as a service and detailed audit logs.

Source-availableBUSL-1.1
Visit website View repository Docs
Homepage of HashiCorp Vault
Official website (developer.hashicorp.com), captured by ThreatWire.

What HashiCorp Vault does

Vault centralises secrets behind an API with authentication methods (tokens, Kubernetes, cloud IAM, OIDC and more) and policies. Secrets engines can generate short-lived dynamic credentials for databases and clouds, act as a PKI, or encrypt data on behalf of applications.

Since version 1.15 its source is published under the Business Source License 1.1, so ThreatWire lists it as source-available. OpenBao is a community fork of the last open-source code.

Key features

  • Static and dynamic secrets
  • PKI and certificate issuance
  • Transit encryption as a service
  • Many auth methods and fine-grained policies
  • Audit devices and HA storage

Licence

BUSL-1.1 · Business Source License 1.1 · Source-available

Vault 1.15 and later are published under BSL 1.1, which is not an open-source licence (each version converts to MPL-2.0 after the change date). GitHub reports NOASSERTION.

Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: NOASSERTION. Source-available means the code is public but the licence is not approved by the Open Source Initiative.

Security of HashiCorp Vault itself

55 published advisories for HashiCorp Vault in GitHub repository advisories and OSV.dev; the 12 most recent are listed. Keep the tool updated: security tools often run with broad access.

  • GHSA-72gw-fmmr-c4r4CVE-2026-4525high2026-04-17

    HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization

  • GHSA-88v5-9hxc-f85rCVE-2026-5807high2026-04-17

    HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations

  • GHSA-8r5m-3f66-qpr3CVE-2026-5052moderate2026-04-17

    HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS

  • GHSA-m2w4-8ggf-rj47CVE-2026-3605high2026-04-17

    HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service

  • GHSA-9g4h-h484-3578CVE-2025-11621high2025-10-23

    HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass

  • GHSA-vp5w-xcfc-73wfCVE-2025-12044high2025-10-23

    Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON

  • GHSA-8f82-53h8-2p34CVE-2025-6203high2025-08-28

    HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads

  • GHSA-7rx2-769v-hrwfCVE-2025-6013moderate2025-08-06

    HashiCorp Vault ldap auth method may not have correctly enforced MFA

  • GHSA-6c5r-4wfc-3mcxCVE-2025-6037moderate2025-08-01

    Hashicorp Vault has Incorrect Validation for Non-CA Certificates

  • GHSA-6h4p-m86h-hhghCVE-2025-5999high2025-08-01

    Hashicorp Vault has Privilege Escalation Vulnerability

  • GHSA-mr4h-qf9j-f665CVE-2025-6000critical2025-08-01

    Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration

  • GHSA-mwgr-84fv-3jh9CVE-2025-6011low2025-08-01

    Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing Users

Sources: GitHub repository advisories, OSV.dev · checked 2026-10-20.

Categories and tags

Identity, access and secrets management#secrets-management#pki#encryption#go#vault#secrets

Related tools

  • Keycloak

    Identity and access management for apps and services

    Identity provider with single sign-on, OpenID Connect, OAuth 2.0 and SAML, user federation, MFA and fine-grained authorisation. A CNCF project.

    Stars
    37k
    Forks
    9.1k
    Last commit
    today
    Apache-2.0Open sourceIdentity, access and secrets management
    Alternative toOktaAuth0

  • Infisical

    Secrets, certificates and access management platform

    Open-core platform to manage application secrets and environment variables across teams and infrastructure, with SDKs, a CLI and secret scanning.

    Stars
    30k
    Forks
    2.4k
    Last commit
    today
    MITOpen sourceIdentity, access and secrets management
    Alternative toHashiCorp Vault

  • OpenBao

    Community fork of Vault under an open-source licence

    Linux Foundation project that forked HashiCorp Vault's last MPL-licensed code to keep an open-source secrets manager with a compatible API.

    Stars
    8.6k
    Forks
    636
    Last commit
    today
    MPL-2.0Open sourceIdentity, access and secrets management
    Alternative toHashiCorp Vault

  • KeePassXC

    Offline, cross-platform password manager

    Community port of KeePass for Windows, macOS and Linux that stores passwords in an encrypted KDBX database file you control.

    Stars
    29k
    Forks
    2k
    Last commit
    1 day ago
    GPL-2.0-only OR GPL-3.0-onlyOpen sourcePasswords and credential auditing
    Alternative to1Password
Share on X@threatwire_https://www.threatwire.tech/tools/vault