Approved changes feed: RSS · Atom
cpe:2.3:a:hashicorp:vault:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Hashicorp (dc524c16-6a01-528e-a41c-9d3e02e5e4a3) |
|---|---|
| Product | Vault (4dadab3d-054a-5498-9618-09dfc641ef81) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/hashicorp/vault/ |
purl2cpe | 2026-06-01 10:14:57.353842 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-12624 |
vulnerable | 2026-09-16 04:32:50.719056 |
Vault vulnerable to LIST authorization bypass via trailing-slash strip
MEDIUM (4.3)
Vault’s ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was intended to be denied access to. This vulnerability (CVE-2026-12624) is fixed in Vault Community Edition 2.0.3 and Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19.
Published: 2026-08-10T17:00:46.283Z
Updated: 2026-08-11T15:52:34.653Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-5051 |
vulnerable | 2026-07-29 01:03:18.153475 |
Audit Log Plugin Directory Guard Bypass via Legacy path Option
MEDIUM (4.4)
HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used.
This vulnerability (CVE-2026-5051) is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17.
Published: 2026-07-01T17:10:56.918Z
Updated: 2026-07-01T17:54:43.314Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-5807 |
vulnerable | 2026-06-08 08:07:04.117399 |
Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations
HIGH (7.5)
Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate operators from completing these workflows. This vulnerability, CVE-2026-5807, is fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0.
Published: 2026-04-17T03:22:13.816Z
Updated: 2026-07-15T00:41:55.881Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-5052 |
vulnerable | 2026-06-08 08:07:02.938497 |
Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS
MEDIUM (5.3)
Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
Published: 2026-04-17T02:55:25.080Z
Updated: 2026-04-17T17:57:55.377Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-4525 |
vulnerable | 2026-06-08 08:05:13.479939 |
Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header
HIGH (7.5)
If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
Published: 2026-04-17T03:00:47.561Z
Updated: 2026-07-15T00:52:47.241Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3605 |
vulnerable | 2026-06-08 08:01:19.045888 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-6203 |
vulnerable | 2026-06-08 07:43:14.530489 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-6037 |
vulnerable | 2026-06-08 07:43:14.162471 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-6015 |
vulnerable | 2026-06-08 07:43:13.975016 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-6014 |
vulnerable | 2026-06-08 07:43:13.974305 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-6013 |
vulnerable | 2026-06-08 07:43:13.973658 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-6011 |
vulnerable | 2026-06-08 07:43:13.967839 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-6004 |
vulnerable | 2026-06-08 07:43:13.953850 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-6000 |
vulnerable | 2026-06-08 07:43:13.939977 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-5999 |
vulnerable | 2026-06-08 07:37:26.234348 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-4656 |
vulnerable | 2026-06-08 07:29:17.028478 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-4166 |
vulnerable | 2026-06-08 07:29:15.503685 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-3879 |
vulnerable | 2026-06-08 07:23:10.062227 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-12044 |
vulnerable | 2026-06-08 07:04:29.601917 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-11621 |
vulnerable | 2026-06-08 07:04:28.622766 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-9180 |
vulnerable | 2026-06-08 07:00:26.853135 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-8365 |
vulnerable | 2026-06-08 07:00:24.373778 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-8185 |
vulnerable | 2026-06-08 07:00:22.975587 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-7594 |
vulnerable | 2026-06-08 06:58:22.807493 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6468 |
vulnerable | 2026-06-08 06:58:19.537805 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-5798 |
vulnerable | 2026-06-08 06:56:17.453312 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2660 |
vulnerable | 2026-06-08 06:33:31.851883 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2048 |
vulnerable | 2026-06-08 06:33:30.202670 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-0831 |
vulnerable | 2026-06-08 06:22:02.942312 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6337 |
vulnerable | 2026-06-08 06:19:46.978800 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5954 |
vulnerable | 2026-06-08 06:19:45.202286 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5077 |
vulnerable | 2026-06-08 06:19:41.373734 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-4680 |
vulnerable | 2026-06-08 06:16:14.138523 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-3462 |
vulnerable | 2026-06-08 06:09:39.628116 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-2121 |
vulnerable | 2026-06-08 06:02:41.454325 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-25000 |
vulnerable | 2026-06-08 05:56:08.312256 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-24999 |
vulnerable | 2026-06-08 05:56:08.309466 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0665 |
vulnerable | 2026-06-08 05:52:32.231657 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0620 |
vulnerable | 2026-06-08 05:52:32.091690 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-36129 |
vulnerable | 2026-06-08 05:46:06.373829 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-35192 |
vulnerable | 2026-06-08 05:25:00.918170 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-19786 |
vulnerable | 2026-06-08 05:11:16.097925 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.