Vulnerability in vault-cli (CVE-2021-43837)
Summary
Vulnerability in vault-cli (CVE-2021-43837). Successful exploitation can lead to full system takeover. Exploitable via vault. Mitigation: upgrade to 3.0.0 or later.
Original description
The description as published by the source.
Impact
What kind of vulnerability is it? Who is impacted?
vault-cli features the ability for rendering templated values (as explained in the documentation). When a secret starts with the prefix !template!, vault-cli interprets the rest of the contents of the secret as a Jinja2 template.
Jinja2 is a powerful templating engine and it's not designed to safely render arbitrary templates. An attacker controlling a jinja2 template rendered on a machine can trigger arbitrary code, making this a Remote Code Execution (RCE) risk.
If the content of the vault can be completely trusted, then this is not a problem. Otherwise, if your threat model includes cases where an attacker can manipulate a secret value read from the vault using vault-cli, then this vulnerability may impact you.
This does not impact vault itself, except for the fact that the attacker, having an RCE on the machine that executes vault-cli, may abuse the token that vault-cli uses, to read, write or delete other data from the vault.
Patches
Has the problem been patched? What versions should users upgrade to?
In 3.0.0, the code related to interpreting vault templated secrets has been removed entirely.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
Using the environment variable VAULT_CLI_RENDER=false or the flag --no-render (placed between vault-cli and…
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2021-43837 has been found in vault-cli.
Attackers can target a specific entry point like vault over the network to misuse the product.
Successful exploitation can lead to full system takeover.
What to do: upgrade vault-cli to 3.0.0 or later.
If unsure, ask your IT team or search "vault-cli CVE-2021-43837" on the vendor's site.
CVE-2021-43837 (vault-cli) — CWE-74
Attack vector: adjacent-network / no user interaction
Attack surface: vault
Patched: 3.0.0 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-74) exists in vault-cli. Attackers reach the vulnerable code path via vault.
Check the vendor advisory for the affected versions of vault-cli. Attack surface: vault.
Severity: ?. Successful exploitation can lead to full system takeover.
Update to 3.0.0.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'vault-cli' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'vault-cli' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
vault-cliを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade vault-cli to 3.0.0ステージング環境で 3.0.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web podalirius.net