| CVE-2026-89322 |
Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and…
|
7.2
Élevée
|
7 oct. 2026 |
| CVE-2026-105816 |
Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within…
|
8.0
Élevée
|
7 oct. 2026 |
| CVE-2026-105818 |
Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when…
|
5.9
Moyenne
|
7 oct. 2026 |
| CVE-2026-5006 |
A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may…
|
6.8
Moyenne
|
24 août 2026 |
| CVE-2026-12624 |
Vault’s ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a…
|
4.3
Moyenne
|
10 août 2026 |
| CVE-2026-5051 |
HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin…
|
4.4
Moyenne
|
1 juil. 2026 |
| CVE-2026-5807 |
Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel…
|
7.5
Élevée
|
17 avr. 2026 |
| CVE-2026-4525 |
If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used…
|
7.5
Élevée
|
17 avr. 2026 |
| CVE-2026-5052 |
Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges
|
5.3
Moyenne
|
17 avr. 2026 |
| CVE-2026-3605 |
An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they…
|
8.1
Élevée
|
17 avr. 2026 |
| CVE-2025-12044 |
Vault and Vault Enterprise (“Vault”) are vulnerable to an unauthenticated denial of service when processing JSON…
|
7.5
Élevée
|
23 oct. 2025 |
| CVE-2025-11621 |
Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the…
|
8.1
Élevée
|
23 oct. 2025 |
| CVE-2025-6203 |
A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit…
|
7.5
Élevée
|
28 août 2025 |
| CVE-2025-6013 |
Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set…
|
6.5
Moyenne
|
6 août 2025 |
| CVE-2025-6015 |
Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused
|
5.7
Moyenne
|
1 août 2025 |
| CVE-2025-6011 |
A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to…
|
3.7
Faible
|
1 août 2025 |
| CVE-2025-6004 |
Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication…
|
5.3
Moyenne
|
1 août 2025 |
| CVE-2025-6037 |
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when…
|
6.8
Moyenne
|
1 août 2025 |
| CVE-2025-6014 |
Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse…
|
6.5
Moyenne
|
1 août 2025 |
| CVE-2025-6000 |
A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution…
|
9.1
Critique
|
1 août 2025 |
| CVE-2025-5999 |
A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or…
|
7.2
Élevée
|
1 août 2025 |
| CVE-2025-4656 |
Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to…
|
3.1
Faible
|
25 juin 2025 |
| CVE-2025-3879 |
Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the…
|
6.6
Moyenne
|
2 mai 2025 |
| CVE-2025-4166 |
Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in…
|
4.5
Moyenne
|
2 mai 2025 |
| CVE-2024-8185 |
Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a…
|
7.5
Élevée
|
31 oct. 2024 |