Vault's Login MFA feature did not consistently enforce the lifetime of pending two-phase login requests. This may allow a user who previously completed the first authentication factor to complete MFA and obtain a Vault token after the pending request should have expired, including after the user's primary credential has been rotated. This vulnerability (CVE-2026-92738) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.26.
Vault Community Edition and Vault Enterprise did not apply explicit ACL policy deny rules to letter case variants of user and group names in auth methods that treat these names as case-insensitive. This may allow an authenticated user with delegated permissions to modify a protected user or group, potentially leading to privilege escalation. This vulnerability (CVE-2026-128100) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.
Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading audit records. This vulnerability (CVE-2026-93333) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.
Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engine, auth method, or audit device that a more specific deny rule was intended to protect. This vulnerability (CVE-2026-93335) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.
HashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow an unauthenticated attacker with network access to a new, uninitialized node to cause that node to send credentials from its server environment to an attacker-controlled server. This vulnerability (CVE-2026-92735) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.
HashiCorp Vault and Vault Enterprise versions prior to 2.1.2 (Community Edition) and certain 1.x Enterprise versions improperly handle case sensitivity when evaluating ACL policies. This flaw allows authenticated users with delegated permissions to bypass explicit deny restrictions, potentially accessing protected resources or assigning denied policies, leading to privilege escalation. The vulnerability is fixed in Vault Community Edition 2.1.2 and Enterprise versions 2.1.2, 1.21.12, 1.20.17, and 1.19.23.
CVE-2026-105816 is a path traversal vulnerability in HashiCorp Vault and Vault Enterprise that allows a privileged operator to execute arbitrary code on the Vault host when restoring an Integrated Storage (Raft) snapshot with an external plugin directory configured. The issue arises because Vault did not consistently verify that plugin catalog entries reference binaries only within the configured plugin directory. This vulnerability has a high severity score of 8.0 and is fixed in Vault Community Edition 2.1.2 and Vault Enterprise versions 2.1.2, 1.21.12, 1.20.17, and 1.19.23.
HashiCorp Vault's PKI secrets engine ACME server had a vulnerability where it did not restrict certificate identities that were not validated by ACME challenges under the default directory policy. This could allow an ACME client to obtain a certificate with unverified identity claims, potentially enabling impersonation against systems trusting certificates from the affected Vault PKI mount. The issue is fixed in Vault Community Edition 2.1.2 and Vault Enterprise versions 2.1.2, 1.21.12, 1.20.17, and 1.19.23.
CVE-2026-5006 is an authorization bypass vulnerability in HashiCorp Vault and Vault Enterprise. An authenticated attacker can manipulate an identity value in a templated policy path, including slash characters, to gain unintended access to Vault paths. This vulnerability was fixed in Vault Community Edition 2.0.4 and Vault Enterprise versions 2.0.4, 1.21.9, 1.20.14, and 1.19.20.
Vault’s ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was intended to be denied access to. This vulnerability (CVE-2026-12624) is fixed in Vault Community Edition 2.0.3 and Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19.
HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used.
This vulnerability (CVE-2026-5051) is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17.
CVE-2026-5052 is a Server-Side Request Forgery (SSRF) vulnerability in HashiCorp Vault's PKI engine ACME validation. The vulnerability allows local network targets to be requested during http-01 and tls-alpn-01 challenge issuance, potentially leading to information disclosure. This issue affects Vault version 1.15.0 and was fixed in Vault Community Edition 2.0.0 and Vault Enterprise versions 2.0.0, 1.21.
If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate operators from completing these workflows. This vulnerability, CVE-2026-5807, is fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0.