HashiCorp Vault and Vault Enterprise contain a flaw in audit device validation logic that fails to enforce directory guard checks when the legacy file audit path option is used. This results in a path traversal weakness (CWE-22) combined with missing or incomplete directory checks (CWE-807). An attacker may exploit the vulnerability by providing a crafted audit path that resolves outside the intended plugin directory, enabling the reading or modification of arbitrary files on the host and thereby compromising confidentiality and integrity of data.

HashiCorp Vault and Vault Enterprise running any version prior to 2.0.1 for Enterprise or 1.21.6, 1.20.11, or 1.19.17 for the Community edition are affected. The issue manifests when the audit configuration enables the legacy file audit path option, bypassing the usual directory guard initializations.

The CVSS base score of 4.4 indicates medium severity, and the EPSS score of less than 1% suggests a very low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, and no public exploits are reported. The likely attack vector is a malicious actor who gains the ability to modify audit device settings, for example by accessing the Vault API with credentials or by editing the configuration files directly. Updating to the patched versions or reconfiguring the audit device to use the default path mitigates the risk.