Assuming that you plan on your Vault being accessible to the public Internet, and that you have enabled audit logging:
Consider a disk-space-based denial of service.
If you enable Vault's audit logging, Vault will log every request, including those that fail authentication. Vault will hash any secrets that may be present in those requests, but will leave any non-secrets (like the keys of an entry in Vault's key/value store) alone.
If you are using the file
audit device, these logs will be written to a file. If an attacker tries to repeatedly write the secret {"(insert ten megabytes of noise here)":"1"}
to Vault, you may run out of disk space.
Mitigation: configure your audit device(s) (and any helper infrastructure) so that at least one audit device won't block. For example, configure logrotate
with a maximum file size.