Threat Intelligence Database

CVE-2026-5006 is an authorization bypass vulnerability in HashiCorp Vault and Vault Enterprise. An authenticated attacker can manipulate an identity value in a templated policy path, including slash characters, to gain unintended access to Vault paths. This vulnerability was fixed in Vault Community Edition 2.0.4 and Vault Enterprise versions 2.0.4, 1.21.9, 1.20.14, and 1.19.20.

Vault’s ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was intended to be denied access to. This vulnerability (CVE-2026-12624) is fixed in Vault Community Edition 2.0.3 and Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19.

HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used. This vulnerability (CVE-2026-5051) is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17.

Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate operators from completing these workflows. This vulnerability, CVE-2026-5807, is fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0.

CVE-2026-5052 is a Server-Side Request Forgery (SSRF) vulnerability in HashiCorp Vault's PKI engine ACME validation. The vulnerability allows local network targets to be requested during http-01 and tls-alpn-01 challenge issuance, potentially leading to information disclosure. This issue affects Vault version 1.15.0 and was fixed in Vault Community Edition 2.0.0 and Vault Enterprise versions 2.0.0, 1.21.

If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

Vault and Vault Enterprise (“Vault”) are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for [+HCSEC-2025-24+|https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393]  which allowed for processing JSON payloads before applying rate limits. This vulnerability, CVE-2025-12044, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.16.27, 1.19.11, 1.20.5, and 1.21.0.

HighVulnerabilityGermanyUnited KingdomFrance+4#cve#cve-2025-12044#cwe-770

Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS accounts, or uses a wildcard. This vulnerability, CVE-2025-11621, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27

HighVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2025-11621#cwe-288

CVE-2025-4656 is a low-severity vulnerability in HashiCorp Vault affecting rekey and recovery key operations. It involves synchronous access of a remote resource without a timeout, which can lead to denial of service caused by uncontrolled cancellation by a Vault operator. The vulnerability has been fixed in Vault Community Edition 1.20.0 and several Enterprise versions.