CVE-2021-38554: Hashicorp Vault

Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days.

HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.

Affected products

• Hashicorp Vault: before 1.8.0 (fixed in 1.8.0)

Published 2021-08-13. Last modified 2026-06-17.