Description
HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used.
This vulnerability (CVE-2026-5051) is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HashiCorp | Vault | 1.20.1 – < 2.0.1 | 2.0.1 |
| HashiCorp | Vault Enterprise | 1.19.0 – < 2.0.1 | 2.0.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | splunk-otel-collector | 0.157.0-r0 | — |
| Wolfi rolling | splunk-otel-collector-compat | 0.160.0-r0 | — |
Advisories 1
- WID-SEC-2026-2167 Hashicorp Vault: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jul 1, 2026