| CVE-2026-89322 |
Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and…
|
7.2
High
|
Oct 7, 2026 |
| CVE-2026-105816 |
Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within…
|
8.0
High
|
Oct 7, 2026 |
| CVE-2026-105818 |
Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when…
|
5.9
Medium
|
Oct 7, 2026 |
| CVE-2026-5006 |
A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may…
|
6.8
Medium
|
Aug 24, 2026 |
| CVE-2026-12624 |
Vault’s ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a…
|
4.3
Medium
|
Aug 10, 2026 |
| CVE-2026-5051 |
HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin…
|
4.4
Medium
|
Jul 1, 2026 |
| CVE-2026-5807 |
Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel…
|
7.5
High
|
Apr 17, 2026 |
| CVE-2026-4525 |
If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used…
|
7.5
High
|
Apr 17, 2026 |
| CVE-2026-5052 |
Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges
|
5.3
Medium
|
Apr 17, 2026 |
| CVE-2026-3605 |
An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they…
|
8.1
High
|
Apr 17, 2026 |
| CVE-2025-12044 |
Vault and Vault Enterprise (“Vault”) are vulnerable to an unauthenticated denial of service when processing JSON…
|
7.5
High
|
Oct 23, 2025 |
| CVE-2025-11621 |
Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the…
|
8.1
High
|
Oct 23, 2025 |
| CVE-2025-6203 |
A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit…
|
7.5
High
|
Aug 28, 2025 |
| CVE-2025-6013 |
Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set…
|
6.5
Medium
|
Aug 6, 2025 |
| CVE-2025-6015 |
Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused
|
5.7
Medium
|
Aug 1, 2025 |
| CVE-2025-6011 |
A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to…
|
3.7
Low
|
Aug 1, 2025 |
| CVE-2025-6004 |
Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication…
|
5.3
Medium
|
Aug 1, 2025 |
| CVE-2025-6037 |
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when…
|
6.8
Medium
|
Aug 1, 2025 |
| CVE-2025-6014 |
Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse…
|
6.5
Medium
|
Aug 1, 2025 |
| CVE-2025-6000 |
A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution…
|
9.1
Critical
|
Aug 1, 2025 |
| CVE-2025-5999 |
A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or…
|
7.2
High
|
Aug 1, 2025 |
| CVE-2025-4656 |
Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to…
|
3.1
Low
|
Jun 25, 2025 |
| CVE-2025-3879 |
Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the…
|
6.6
Medium
|
May 2, 2025 |
| CVE-2025-4166 |
Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in…
|
4.5
Medium
|
May 2, 2025 |
| CVE-2024-8185 |
Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a…
|
7.5
High
|
Oct 31, 2024 |