Skip to content
OpenAdvisories
Medium WID-SEC-2026-4553 3 CVEs

Hashicorp Vault: Mehrere Schwachstellen

Published Nov 12, 2026 · Updated Nov 12, 2026 · de

Vendor: HashiCorp Product: Vault Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Hashicorp Vault ausnutzen, um Informationen offenzulegen, um Dateien zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.

Product

Vault ist ein identitätsbasiertes System zur Verwaltung von Geheimnissen und Verschlüsselung.

Vulnerabilities 3

  • Medium 6.5
    CVE-2026-93335

    Vault vulnerable to ACL deny bypass via trailing slash

    Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration pa…

    HashiCorp Vault Enterprise Vault
  • Medium 5.9
    CVE-2026-92735

    Vault integrated storage join may disclose server environment credentials

    HashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow an unauthenticated attacker with network access to a new, uninitialized node to cause that node to send credentials from its server environme…

    HashiCorp Vault Enterprise Vault
  • Low 2.7
    CVE-2026-93333

    Vault audit device prefix vulnerable to log injection

    Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentia…

    HashiCorp Vault Enterprise Vault

Revision history

  1. #1

    Initiale Fassung

References