Posted by Felix Wilhelm, Project Zero IntroductionIn this blog post I'll discuss two vulnerabilities in HashiCorp Vault and its integration with Amazon Web Services (AWS) and Google Cloud Platform (GCP). These issues can lead to an authentication bypass in configurations that use the aws and gcp auth methods, and demonstrate the type of issues you can find in modern “cloud-native” software. Both v
![Enter the Vault: Authentication Issues in HashiCorp Vault](https://cdn-ak-scissors.b.st-hatena.com/image/square/27005a972c9db0956826801541c956b4601f364d/height=288;version=1;width=512/https%3A%2F%2Fblogger.googleusercontent.com%2Fimg%2Fb%2FR29vZ2xl%2FAVvXsEitcKspf5Rh-dLLZWKenbqIJIlRheTsqw0aBX0RraSuO2M49gTY5BmvEl-niDIBAua0Z9v6YbB9nfdqX_FHO378-AMDeoLqdQdnXyW8E8xzjgpbwRaDxDoJTpoC45_0WwbNVnbKhT5qra7zQ2MNEGBAUnefFjBvTtwaSYOpUcfet0FKifsAxHlQe15r%2Fw1200-h630-p-k-no-nu%2Fvault.png)