Skip to content
OpenAdvisories

Product · HashiCorp

Tooling

13 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-110720 Public exploit

    Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules

    Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and…

    HashiCorp Tooling
  • Critical 9.6
    CVE-2026-8715

    Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath

    Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod…

    HashiCorp Tooling
  • Critical 10.0
    CVE-2026-16326

    consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

    In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is f…

    HashiCorp Tooling
  • Critical 10.0
    CVE-2026-16498

    terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

    The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This…

    HashiCorp Tooling