Skip to content
OpenAdvisories
High WID-SEC-2026-1164 4 CVEs

Hashicorp Vault Community Edition und Enterprise: Mehrere Schwachstellen

Published Apr 16, 2026 · Updated Apr 16, 2026 · de-DE

Vendor: HashiCorp Product: Vault

Summary

Ein Angreifer kann mehrere Schwachstellen in Hashicorp Vault ausnutzen, um Daten zu manipulieren, einen Denial-of-Service-Zustand zu verursachen oder vertrauliche Informationen offenzulegen, was möglicherweise eine Privilegienerweiterung ermöglicht.

Product

Vault ist ein identitätsbasiertes System zur Verwaltung von Geheimnissen und Verschlüsselung.

Vulnerabilities 4

  • High 8.1
    CVE-2026-3605

    Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service

    An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets ac…

    HashiCorp Vault Enterprise Vault splunk-otel-collector Alpine Wolfi Go
  • High 7.5
    CVE-2026-4525

    Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header

    If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

    HashiCorp Vault Enterprise Vault splunk-otel-collector Wolfi Go
  • High 7.5
    CVE-2026-5807

    Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations

    Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate operators from comple…

    HashiCorp Vault Enterprise Vault splunk-otel-collector Alpine Wolfi Go
  • Medium 5.3
    CVE-2026-5052

    Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS

    Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edi…

    HashiCorp Vault Enterprise Vault splunk-otel-collector Wolfi Go

Revision history

  1. #1

    Initiale Fassung

References