Security & compliance

Improper certificate validation on LDAPS connections to Active Directory allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controller certificate.

Improper access control in the vault entry listing feature allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters.

Server-Side Request Forgery (SSRF) in the VMware synchronization feature allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for datacenter discovery.

Improper certificate validation in the shared HTTP client used by synchronization and integration features allows a network-positioned attacker to intercept and tamper with outbound TLS connections via a spoofed or self-signed certificate.