CVE-2024-1052 is a High severity flaw, scored 8.0 in the record, in HashiCorp Boundary and Boundary Enterprise. An attacker with specific privileges can craft a TLS certificate to hijack an active session. HashiCorp's bulletin HCSEC-2024-02 lists 0.15.0 or newer as the fixed release.
What's affected
HashiCorp's bulletin says Boundary and Boundary Enterprise from 0.8.0 onward are affected, and that version 0.15.0 or newer fixes the issue.
On severity, the record carries a CVSS score of 8.0 (High). The HashiCorp page gives no numeric score. It describes attack complexity as high and the required access as high. Those two points are consistent with each other: the flaw is serious, but an attacker needs a lot in hand first.
How to check if you're exposed
Read your Boundary version from the controllers and workers.
boundary version
Any result from 0.8.0 up to but not including 0.15.0 is affected. HashiCorp also suggests searching Boundary logs for the string below, which indicates attempts to use invalid trust on first use (TOFU) tokens.
WARNING: mismatched tofu token
A hit is a lead for investigation, not proof of compromise.
What to do now
- Run
boundary versionon controllers and workers and list anything from 0.8.0 to before 0.15.0. - Plan an upgrade to Boundary 0.15.0 or later and follow the upgrade guidance HashiCorp links from the bulletin.
- Search logs for the mismatched TOFU token message and review any matches with the session and user involved.
- Review who holds privileges to list active or pending sessions. The attack needs that access, so narrowing it reduces the chance of misuse.
- Record the new version in your inventory.
Why it matters
The class is improper certificate validation, CWE-295. Boundary brokers access to services, so a session that can be taken over inherits the reach of the original user. The bulletin's conditions are demanding: the attacker must be able to enumerate active or pending sessions, obtain a private key tied to a session, and hold a valid TOFU token. That explains the high complexity rating.
Still, tools that broker access are high value. A flaw that needs insider level privileges matters most in environments where those privileges are widely held. The record shows the CISA KEV flag as false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Boundary version fixes CVE-2024-1052?
HashiCorp says 0.15.0 or newer. Affected versions start at 0.8.0.
How can I tell whether someone tried it?
HashiCorp suggests searching Boundary logs for the text WARNING: mismatched tofu token. A match is a lead, not proof.
Sources
Last reviewed: 19 October 2026.
