CVE-2021-30476: Hashicorp Terraform Provider

Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days.

HashiCorp Terraform’s Vault Provider (terraform-provider-vault) did not correctly configure GCE-type bound labels for Vault’s GCP auth method. Fixed in 2.19.1.

Affected products

• Hashicorp Terraform Provider: before 2.19.1 (fixed in 2.19.1)

Published 2021-04-22. Last modified 2026-06-17.