vault: writes the master key to the server log
Published Dec 5, 2018
7.3
HIGHCVSS 3.1
EPSS 0.93%
Description
HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autoseal mechanism without an error being reported.
Affected products
No data.
No data.
Logging Subsystem for Red Hat OpenShift
openshift-logging/logging-loki-rhel9
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-installer
Not affected
Red Hat OpenShift Container Platform 4
openshift4/topology-aware-lifecycle-manager-rhel8-operator
Not affected
Red Hat Openshift Container Storage 4
ocs4/cephcsi-rhel8
Not affected
Red Hat Openshift Container Storage 4
ocs4/mcg-rhel8-operator
Not affected
Red Hat Openshift Container Storage 4
ocs4/ocs-rhel8-operator
Not affected
Red Hat Openshift Container Storage 4
ocs4/rook-ceph-rhel8-operator
Not affected
Red Hat Openshift Data Foundation 4
odf4/cephcsi-rhel9
Not affected
Red Hat Openshift Data Foundation 4
odf4/mcg-rhel9-operator
Not affected
Red Hat Openshift Data Foundation 4
odf4/ocs-rhel9-operator
Not affected
Red Hat Openshift Data Foundation 4
odf4/odf-multicluster-rhel9-operator
Not affected
Red Hat Openshift Data Foundation 4
odf4/odf-rhel9-operator
Not affected
Red Hat Openshift Data Foundation 4
odf4/odr-rhel9-operator
Not affected
Red Hat Openshift Data Foundation 4
odf4/rook-ceph-rhel9-operator
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Logging Subsystem for Red Hat OpenShift | openshift-logging/logging-loki-rhel9 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-installer | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/topology-aware-lifecycle-manager-rhel8-operator | Not affected | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/cephcsi-rhel8 | Not affected | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/mcg-rhel8-operator | Not affected | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/ocs-rhel8-operator | Not affected | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/rook-ceph-rhel8-operator | Not affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/cephcsi-rhel9 | Not affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/mcg-rhel9-operator | Not affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/ocs-rhel9-operator | Not affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/odf-multicluster-rhel9-operator | Not affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/odf-rhel9-operator | Not affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/odr-rhel9-operator | Not affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/rook-ceph-rhel9-operator | Not affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:N/AC:M/Au:N/C:P/I:N/A:N
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2021–2026- EPSS v1
- EPSS v5
- EPSS v2
- EPSS v3
Percentile over time
- EPSS v1
- EPSS v5
- EPSS v2
- EPSS v3
Table of values (9 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 0.93% (0.00934) | 59.31th | v5 (v2026.06.15) |
| Sep 20, 2026 | 0.93% (0.00934) | 59.20th | v5 (v2026.06.15) |
| Jul 20, 2024 | 0.22% (0.00222) | 60.93th | v3 (v2023.03.01) |
| Jun 13, 2024 | 0.22% (0.00222) | 60.63th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.22% (0.00222) | 58.63th | v3 (v2023.03.01) |
| Mar 6, 2023 | 0.89% (0.00885) | 27.89th | v2 (v2022.01.01) |
| Feb 4, 2022 | 0.89% (0.00885) | 10.50th | v2 (v2022.01.01) |
| Feb 3, 2022 | 0.42% (0.00416) | 10.04th | v5 (v2026.06.15) |
| Apr 14, 2021 | 0.42% (0.00416) | 0.00th | v1 |
References (5)
- https://access.redhat.com/security/cve/CVE-2018-19786 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2189763 Issue Tracking
- https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#100-december-3rd-2018 x_refsource_CONFIRMRelease NotesThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2018-19786
- https://www.cve.org/CVERecord?id=CVE-2018-19786
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2018-19786 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2189763 | Issue Tracking | |
| https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#100-december-3rd-2018 | x_refsource_CONFIRMRelease NotesThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2018-19786 | ||
| https://www.cve.org/CVERecord?id=CVE-2018-19786 |
Change history (0)
No recorded changes yet.