Skip to main content
protocols.pageprotocols.page
8500

Port 8500 – HashiCorp Vault

TCP

Port 8200 is the default HashiCorp Vault HTTP API port. Vault manages secrets, encryption keys, and dynamic credentials. Port 8200 should be accessible only from application servers that need secrets – never from the public internet. Vault requires TLS in production. The Vault agent sidecar uses port 8200 to retrieve secrets for applications.

Port Number

8500

Protocol

TCP

Service

Vault HTTP API

Range

IANA Registered (1024–49151)

Description

HashiCorp Vault on port 8200 provides secrets management: static secrets, dynamic database credentials, PKI certificate generation, and encryption-as-a-service. Vault uses a seal/unseal mechanism – it starts sealed and requires unseal keys or AWS KMS/Azure Key Vault auto-unseal to become operational. The Vault UI also runs on port 8200 and should be restricted to internal networks.

Security risks

  • 1CVE-2023-24999: Vault PKI secrets engine allowed issuing certificates with arbitrary SANs beyond the allowed_domains, enabling TLS impersonation (fixed 1.12.4, 1.13.1)
  • 2CVE-2022-36129: Vault entity alias bypass – attacker could escalate privileges by creating entity aliases that map to higher-privilege policies (fixed 1.11.4)
  • 3Root token exposure: Vault generates a root token on initialization. If stored insecurely (logged, emailed, in a file), it gives permanent full access to all secrets
  • 4Unsealed Vault without TLS: transit traffic to/from Vault contains plaintext secrets, auth tokens, and encryption keys if TLS is not enforced (disable_mlock + no TLS = worst case)
  • 5Overly broad policies: Vault policies granting path 'secret/*' capabilities 'read,list' to application identities expose all secrets when only specific paths are needed

Firewall guidance

Port 8200 should be reachable only from: (1) application servers using Vault agent/SDK, (2) CI/CD systems for dynamic secrets, (3) admin workstations for management. Never internet-facing. Enforce TLS: listener 'tcp' { tls_cert_file, tls_key_file, tls_disable = 0 }. In Kubernetes, use the Vault Agent Injector sidecar (applications never directly reach port 8200).

Diagnosis commands

Check Vault status (sealed? standby? initialized?)

shell
curl -s http://127.0.0.1:8200/v1/sys/health | jq '{initialized, sealed, standby}'

List enabled audit devices (should have at least one for compliance)

shell
curl -s -H 'X-Vault-Token: TOKEN' http://127.0.0.1:8200/v1/sys/audit | jq '.data | keys'

Inspect current token's policies and TTL

shell
vault token lookup

Verify audit logging is active (required for security compliance)

shell
vault audit list -detailed

Usage examples

Port 8500 – HashiCorp Vault
shell
vault status
curl -H 'X-Vault-Token: TOKEN' http://127.0.0.1:8200/v1/sys/health
vault kv get secret/myapp

Common services on this port

HashiCorp VaultOpenBao (Vault fork)Vault AgentVault CSI Provider (Kubernetes)

Related ports

8200

Vault HTTP API (this port)

8201

Vault cluster/replication (HA)

8500

Consul (Vault storage backend)

History

HashiCorp Vault was released in 2015 to solve secrets sprawl (credentials in config files, environment variables, and source code). Port 8200 was chosen as a common development port. Vault introduced concepts like dynamic secrets (database credentials with TTL), leases, and seal/unseal. The integrated storage backend (Raft) eliminated the Consul dependency in 2019. HashiCorp changed Vault's license to BSL in August 2023, leading to the OpenBao fork.

FAQ

How do I recover if Vault is sealed and I lost unseal keys?

If using Shamir's Secret Sharing: you need the threshold number of unseal keys (typically 3 of 5). If all keys are lost, the data is unrecoverable by design – this is the security model. Prevention: use auto-unseal with AWS KMS, Azure Key Vault, or GCP Cloud KMS. Auto-unseal means Vault automatically unseals on restart without human intervention. Always store recovery keys in a secure, tested backup location.

Vault vs AWS Secrets Manager?

Vault: multi-cloud, dynamic secrets (auto-rotating DB creds), PKI engine, transit encryption, identity-based access, self-hosted or HCP. AWS Secrets Manager: AWS-native, simpler, automatic rotation for RDS/Redshift/DocumentDB, tighter IAM integration, no operational overhead. Use Vault when: multi-cloud, complex policies, dynamic credentials for non-AWS services, or PKI needs. Use Secrets Manager when: AWS-only and operational simplicity matters.