Skip to content
fr Sign in
7.5 High

CVE-2026-5807 Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel…

Description

Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate operators from completing these workflows. This vulnerability, CVE-2026-5807, is fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0.

Affected products and versions

Product Affected versions Fixed in
Vault 2.0 earliest → < 2.0.0 2.0.0
Vault Enterprise Versions not published
Red Hat Openshift Data Foundation 4 Versions not published
Red Hat OpenShift Container Platform 4 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Vault

The 43 CVEs of Vault →
CVE-2026-89322 Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and… 7.2 High CVE-2026-105816 Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within… 8.0 High CVE-2026-105818 Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when… 5.9 Medium CVE-2026-5006 A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may… 6.8 Medium
Track this CVE