Threats affecting pkg:github/Boundary

HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue outbound requests to a network destination of the requester's choosing and to receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service. This vulnerability, CVE-2026-13303, is fixed in Boundary Enterprise 1.0.2 and 0.21.6.

CVE-2026-7776 is a denial-of-service vulnerability in HashiCorp Boundary Community and Enterprise Editions affecting worker nodes during TLS handshakes. An attacker with network access to the worker authentication listener can open connections and delay or withhold client certificates, causing the worker connection handling to block. This blocks legitimate worker connections from being accepted or routed, potentially disrupting service availability. The vulnerability is fixed in Boundary versions 0.21.3, 0.20.3, and 0.19.5.