Skip to content
OpenAdvisories
High WID-SEC-2026-3803 4 CVEs

Hashicorp Vault: Mehrere Schwachstellen

Published Oct 7, 2026 · Updated Oct 7, 2026 · de-DE

Vendor: HashiCorp Product: Vault Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Hashicorp Vault ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen oder seine Privilegien zu erweitern.

Product

Vault ist ein identitätsbasiertes System zur Verwaltung von Geheimnissen und Verschlüsselung.

Vulnerabilities 4

  • High 8.0
    CVE-2026-105816

    Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots

    Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory configured, a privileged operator able to re…

    HashiCorp Vault Enterprise Vault
  • High 7.2
    CVE-2026-89322

    Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions

    Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resour…

    HashiCorp Vault Enterprise Vault
  • Medium 5.9
    CVE-2026-105818

    Vault PKI ACME Issues Certificate With Unvalidated SANs

    Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified ident…

    HashiCorp Vault Enterprise Vault
  • Medium 5.4
    CVE-2026-105820

    Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution

    Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root name…

    HashiCorp Vault Enterprise

Revision history

  1. #1

    Initiale Fassung

References