Notifications
Clear all
Topic starter
09/07/2026 3:28 pm
TL;DR: Nine previously unknown zero-day vulnerabilities in HashiCorp Vault, including lockout bypasses, MFA weaknesses, certificate impersonation, root privilege escalation, and the first public RCE in Vault, were found, according to CYATA, showing how logic flaws in authentication and policy enforcement can break the system’s trust model. The lesson for practitioners is that secrets infrastructure needs behavioral testing and identity-aware review, not just patching and perimeter assumptions.
NHIMG editorial — based on content published by CYATA: LLMjacking: How Attackers Hijack AI Using Compromised NHIs
Questions worth separating out
Q: What breaks when a secrets vault has authentication logic flaws?
A: When a secrets vault has authentication logic flaws, attackers can often move from probing accounts to bypassing lockouts, impersonating identities, and escalating privileges inside the trust plane.
Q: Why do secrets vaults create high-impact NHI risk?
A: Secrets vaults create high-impact NHI risk because they centralise the credentials that non-human systems use to authenticate and retrieve access.
Q: How can security teams evaluate certificate-based machine identity safely?
A: Security teams should evaluate whether certificate possession, subject identity, and policy inheritance are all bound together.
Practitioner guidance
- Test authentication behaviour across identity normalization edge cases Validate username casing, alias handling, and error messaging in every auth backend.
- Verify MFA enforcement at the entity and cache boundary Check whether TOTP or similar factors can be replayed across entity switches, overlapping TTL windows, or per-entity rate-limit gaps.
- Reassess certificate subject binding for machine identities Confirm that certificate subject fields are bound to the intended entity before any policy inheritance occurs.
What's in the full article
CYATA's full research covers the operational detail this post intentionally leaves for the source:
- The complete vulnerability-by-vulnerability breakdown across userpass, LDAP, TOTP, certificate auth, and policy enforcement.
- The disclosure timeline, patch coordination details, and HashiCorp response notes that support remediation planning.
- The proof-of-concept logic paths behind lockout bypass, impersonation, and root escalation.
- The specific CVEs assigned to each flaw, useful for internal tracking and advisory correlation.
👉 Read CYATA's full analysis of HashiCorp Vault logic flaws and CVEs →
HashiCorp Vault logic flaws: what they mean for secrets governance?
Explore further
09/07/2026 3:48 pm
Secrets vaults are not just storage systems. They are identity enforcement systems. Vaults sit at the point where authentication, policy, and secret issuance converge, so a logic flaw in any one layer can become a control-plane failure. In NHI governance terms, the vault is part of the identity perimeter, not merely a back-end utility, and practitioners should treat it as a privileged trust anchor.
A few things that frame the scale:
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches, according to The 2025 State of NHIs and Secrets in Cybersecurity.
- 62% of all secrets are duplicated and stored in multiple locations, according to The 2025 State of NHIs and Secrets in Cybersecurity.
A question worth separating out:
Q: Who is accountable when a secrets platform compromise exposes downstream credentials?
A: Accountability sits with the teams that own the vault, the identity model, and the secrets lifecycle. NIST CSF and NHI governance practices both imply that the control plane must be treated as a critical trust asset, because its failure can cascade into many other privileged systems.
👉 Read our full editorial: HashiCorp Vault logic flaws expose the trust model behind secrets
