Skip to content

Known vulnerabilities in HashiCorp Tooling

Is your version affected?

CVE Summary Score Published
CVE-2026-110720 Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding… 9.9 Critical Oct 26, 2026
CVE-2026-8715 Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in… 9.6 Critical Aug 13, 2026
CVE-2026-16326 In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may… 10.0 Critical Jul 29, 2026
CVE-2026-16498 The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the… 10.0 Critical Jul 28, 2026

Other HashiCorp products