Threats tagged 'ghsa-wfcg-cjg6-q966'

HashiCorp Vault and Vault Enterprise have a vulnerability in the integrated storage join process that allows an unauthenticated attacker with network access to a new, uninitialized node to cause that node to send credentials from its server environment to an attacker-controlled server. This issue is identified as CVE-2026-92735 and has a medium severity rating with a CVSS score of 5.9. The vulnerability is fixed in Vault Community Edition 2.2.2 and Vault Enterprise versions 2.2.2, 1.21.14, and 1.19.25.