CVE-2023-0690 json
Boundary Workers Store Rotated Credentials in Plaintext Even When a Key Management Service Configured
published 2023-02-08 3 y ago modified 2026-06-17 4 mo ago also GHSA-9vrm-v9xv-x3xr , GO-2023-1898 , EUVD-2023-2019
- cvss
- 5.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
HashiCorp Boundary from 0.10.0 through 0.11.2 contain an issue where when using a PKI-based worker with a Key Management Service (KMS) defined in the configuration file, new credentials created after an automatic rotation may not have been encrypted via the intended KMS. This would result in the credentials being stored in plaintext on the Boundary PKI worker’s disk.
This issue is fixed in version 0.12.0.
Patch / fix
- go github.com/hashicorp/boundary 0.12.0
- hashicorp boundary 0.12.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.0 | CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N |
| NVD | 3.1 | 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/hashicorp/boundary | >=0.10.0, <0.12.0 |
0.12.0 |
Affected products
- HashiCorp Boundary
Classification
References
Sources
- CVE List CVE-2023-0690
- GitHub Advisory GHSA-9vrm-v9xv-x3xr
- NVD CVE-2023-0690
- OSV GO-2023-1898
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.