Yes, but it's (reasonably) excluded from their threat model: https://github.com/hashicorp/vault/issues/1446#issuecomment-...