The vulnerability stems from improper file permission handling during BoltDB initialization for Vault's Integrated Storage. The Raft backend setup in physical/raft/raft.go would be responsible for creating the vault.db file. Prior to 1.8.0, the code likely used default or overly broad file modes when calling bolt.Open(), resulting in CWE-281. The fix in 1.8.0 would have adjusted the file mode parameter to enforce stricter permissions (e.g., 0600). While exact code diffs aren't provided, the described vulnerability pattern and HashiCorp's remediation guidance strongly implicate the Raft storage initialization logic.