CVE-2020-12757: Hashicorp Vault

Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days.

HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease duration instead of the engine-configured setting. This may lead to generated GCP credentials being valid for longer than intended. Fixed in 1.4.2.

Affected products

• Hashicorp Vault: from 1.4.0, before 1.4.2 (fixed in 1.4.2)

Published 2020-06-10. Last modified 2026-06-17.