Vault is vulnerable to a denial‑of‑service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in‑progress operation slot. This forces legitimate operators to wait until the operation completes or times out, effectively blocking critical administrative workflows that rely on root access. The underlying weakness is a resource exhaustion flaw (CWE‑770).

The vulnerability affects all installations of HashiCorp Vault Community Edition and Vault Enterprise that are prior to version 2.0.0. Operators running any earlier release are subject to the denial‑of‑service attack, whereas deployments on 2.0.0 or later contain the fix.

The CVSS score of 7.5 classifies the flaw as high severity, and the absence of authentication requirements means an attacker only needs network access to the Vault API. The exploitability is straightforward: by repeatedly issuing root token or rekey commands, an unauthenticated attacker can monopolize the single operation slot. Current EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, but the high CVSS score coupled with the lack of safeguards makes it a significant threat to operational availability.