HashiCorp Boundary is a modern privileged access management (PAM) solution that provides identity-based access to hosts and services without distributing credentials to end users. It proxies sessions through worker nodes, using Vault for dynamic credential brokering. Security concerns unique to Boundary include: overly broad host set definitions allowing users to access unintended targets within an authorized scope, brokered credentials (SSH, database) delivered with higher privilege than the target role requires, Boundary session tokens being long-lived and transferable enabling lateral movement if stolen, worker nodes being single points of failure whose compromise allows MitM of all proxied sessions, and the Boundary controller API granting excessive scope management permissions to non-admin users. This guide covers systematic Boundary security assessment.
# Boundary Controller API: port 9200 (API), port 9201 (cluster), port 9203 (ops/health)
# Boundary Desktop Client uses port 9200
# Check Boundary health endpoint
curl -s http://boundary.example.com:9203/health 2>/dev/null | python3 -m json.tool | head -10
# Returns health status without authentication
# Authenticate via Boundary CLI
export BOUNDARY_ADDR=https://boundary.example.com:9200
boundary authenticate password \
-auth-method-id=ampw_1234567890 \
-login-name=testuser \
-password=testpass 2>/dev/null | head -10
# On success: returns token stored in BOUNDARY_TOKEN env var
# Enumerate all scopes accessible to current user
boundary scopes list -token=${BOUNDARY_TOKEN} 2>/dev/null | head -20
# Enumerate all targets within accessible scopes
boundary targets list -scope-id=p_1234567890 \
-token=${BOUNDARY_TOKEN} 2>/dev/null | head -20
# Get target details including host set membership
boundary targets read -id=ttcp_1234567890 \
-token=${BOUNDARY_TOKEN} 2>/dev/null | head -20# Boundary host sets define which hosts a target includes
# Over-broad host sets allow users to reach unintended systems
# List all hosts in a host set
boundary host-sets read -id=hsst_1234567890 \
-token=${BOUNDARY_TOKEN} 2>/dev/null | grep -E "(host_id|address|name)"
# List all hosts in a catalog
boundary hosts list -host-catalog-id=hcst_1234567890 \
-token=${BOUNDARY_TOKEN} 2>/dev/null | head -20
# Try connecting to a target — this will:
# 1. Create a Boundary session
# 2. Broker credentials from the attached credential library
# 3. Return a local proxy port to use
boundary connect -target-id=ttcp_1234567890 \
-token=${BOUNDARY_TOKEN} -- ls -la 2>/dev/null | head -10
# Reveals actual host being connected to and credentials broekred
# Check credential libraries attached to targets
boundary credential-libraries list \
-credential-store-id=csvlt_1234567890 \
-token=${BOUNDARY_TOKEN} 2>/dev/null | head -15
# Lists Vault credential libraries — check for over-privileged Vault roles| Security Test | Method | Risk |
|---|---|---|
| Broad host set allows access to unintended targets | List hosts in set — check for hosts outside intended scope | High |
| Credential library brokers over-privileged role | Connect to target — inspect brokered SSH user/database role | High |
| Session token reuse for lateral movement | Export BOUNDARY_TOKEN — use from different host to connect sessions | High |
| Scope listing reveals sensitive infrastructure | boundary targets list — enumerates all accessible hosts | Medium |
| Worker node compromise enables session MitM | Access worker host — inspect session proxy traffic | Critical |
| Controller API accessible without mTLS | curl :9200/v1/scopes without client cert | Medium |
Ironimo tests HashiCorp Boundary deployments for over-broad host set definitions allowing unintended target access, over-privileged Vault credential library brokering, session token hijacking enabling lateral movement, worker node compromise risk, scope privilege escalation via misconfigured IAM bindings, controller API token over-privilege, and Vault integration credential over-brokering for unauthorized resource access.
Start free scan