The vulnerability CVE-2026-5052 in HashiCorp Vault's PKI engine relates to improper validation of ACME challenge targets. Specifically, the ACME validation process failed to reject local network addresses when issuing http-01 and tls-alpn-01 challenges. This allows an attacker to cause the Vault server to send requests to internal network targets, which may result in information disclosure. The vulnerability is classified as CWE-918 (Server-Side Request Forgery). It affects Vault version 1.15.0 and was addressed in subsequent releases including Vault Community Edition 2.0.0 and Vault Enterprise versions 2.0.0, 1.21.5, 1.20.10, and 1.19.16. The CVSS score of 5.3 reflects a medium impact primarily on confidentiality with no impact on integrity or availability.

Successful exploitation of this SSRF vulnerability could lead to information disclosure by allowing unauthorized requests to internal network resources through the Vault server. There is no indication of impact on data integrity or availability. No known exploits have been reported in the wild.

A fix for this vulnerability is available in Vault Community Edition 2.0.0 and Vault Enterprise versions 2.0.0, 1.21.5, 1.20.10, and 1.19.16. Users should upgrade to one of these fixed versions to remediate the vulnerability. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated.