CVE-2026-105818: CWE-345: Insufficient Verification of Data Authenticity in HashiCorp Vault

CVE-2026-105818 is a vulnerability in HashiCorp Vault's PKI secrets engine ACME server where insufficient verification of data authenticity (CWE-345) allowed issuance of certificates containing unverified identity claims. The default directory policy did not restrict certificate identities that ACME challenges failed to validate, potentially enabling an attacker to obtain certificates that could be used for impersonation against systems trusting Vault-issued certificates. This vulnerability affects Vault versions >=1.14.0 and prior to the fixed versions 2.1.2 (Community), 2.1.2, 1.21.12, 1.20.17, and 1.19.23 (Enterprise).

An attacker with access to the Vault PKI ACME server could obtain certificates containing unverified identity claims. Such certificates might be trusted by systems relying on Vault-issued certificates, enabling potential impersonation attacks. The vulnerability does not impact confidentiality or availability but impacts integrity by allowing issuance of unauthorized certificates.

This vulnerability is fixed in Vault Community Edition 2.1.2 and Vault Enterprise versions 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Users should upgrade to these versions or later to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.