CVE-2024-2877

—

CVSS 3.1

5.5 medium

EPSS

<1%p7

Published

Apr 30, 2024 (Apr 30, 2024)

Modified

Jun 17, 2026

Description

Vault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log request headers on the standby node. These logs may have included sensitive HTTP request information in cleartext. This vulnerability, CVE-2024-2877, was fixed in Vault Enterprise 1.15.8.

Vendors: hashicorp
Products: vault
Weakness: CWE-532
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.