Vulnerability-Lookup

CVE-2026-4525 (GCVE-0-2026-4525)

Vulnerability from cvelistv5 – Published: 2026-04-17 03:00 – Updated: 2026-06-30 12:10

Title

Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header

Summary

If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-201 - Insertion of Sensitive Information Into Sent Data

Assigner

HashiCorp

References

4 references

URL	Tags
https://discuss.hashicorp.com/t/hcsec-2026-07-vau…
https://access.redhat.com/security/cve/CVE-2026-4525	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2459107	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex

Impacted products

4 products

Vendor	Product	Version
HashiCorp	Vault	Affected: 0.11.2 , < 2.0.0 (semver)
HashiCorp	Vault Enterprise	Affected: 0.11.2 , < 2.0.0 (semver)
Red Hat	Red Hat Openshift Data Foundation 4	cpe:/a:redhat:openshift_data_foundation:4
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Credits

This issue was identified and reported by Oleh Konko of 1seal.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4525",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-17T13:19:26.452614Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-17T13:19:32.463Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4"
            ],
            "defaultStatus": "affected",
            "product": "Red Hat Openshift Data Foundation 4",
            "vendor": "Red Hat"
          },
          {
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-04-17T03:00:47.561Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Vault. When a Vault authentication mount is configured to pass through the \"Authorization\" header, and this header is used for authentication, Vault incorrectly forwards the sensitive Vault token to the authentication plugin backend. This can lead to the disclosure of authentication tokens to potentially untrusted or compromised backend plugins, enabling unauthorized access or further system compromise."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-201",
                "description": "Insertion of Sensitive Information Into Sent Data",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T12:10:40.586Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-4525"
          },
          {
            "name": "RHBZ#2459107",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459107"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4525.json"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-04-17T04:01:24.934Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-04-17T03:00:47.561Z",
            "value": "Made public."
          }
        ],
        "title": "Vault: Vault: Information disclosure of authentication tokens via incorrect header handling",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "64 bit",
            "32 bit",
            "x86",
            "ARM",
            "MacOS",
            "Windows",
            "Linux"
          ],
          "product": "Vault",
          "repo": "https://github.com/hashicorp/vault",
          "vendor": "HashiCorp",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "affected",
              "version": "0.11.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "64 bit",
            "32 bit",
            "x86",
            "ARM",
            "MacOS",
            "Windows",
            "Linux"
          ],
          "product": "Vault Enterprise",
          "repo": "https://github.com/hashicorp/vault",
          "vendor": "HashiCorp",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.19.16",
                  "status": "unaffected"
                },
                {
                  "at": "1.20.10",
                  "status": "unaffected"
                },
                {
                  "at": "1.21.5",
                  "status": "unaffected"
                }
              ],
              "lessThan": "2.0.0",
              "status": "affected",
              "version": "0.11.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was identified and reported by Oleh Konko of 1seal."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIf a Vault auth mount is configured to pass through the \"Authorization\" header, and the \"Authorization\" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.\u003c/p\u003e\u003cbr/\u003e"
            }
          ],
          "value": "If a Vault auth mount is configured to pass through the \"Authorization\" header, and the \"Authorization\" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-118",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-118: Collect and Analyze Information"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-201",
              "description": "CWE-201: Insertion of Sensitive Information Into Sent Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-17T17:22:41.255Z",
        "orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
        "shortName": "HashiCorp"
      },
      "references": [
        {
          "url": "https://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344"
        }
      ],
      "source": {
        "advisory": "HCSEC-2026-08",
        "discovery": "EXTERNAL"
      },
      "title": "Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
    "assignerShortName": "HashiCorp",
    "cveId": "CVE-2026-4525",
    "datePublished": "2026-04-17T03:00:47.561Z",
    "dateReserved": "2026-03-20T17:47:40.835Z",
    "dateUpdated": "2026-06-30T12:10:40.586Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-4525",
      "date": "2026-07-08",
      "epss": "0.00406",
      "percentile": "0.32536"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-4525\",\"sourceIdentifier\":\"security@hashicorp.com\",\"published\":\"2026-04-17T04:16:09.997\",\"lastModified\":\"2026-06-30T03:20:34.070\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"If a Vault auth mount is configured to pass through the \\\"Authorization\\\" header, and the \\\"Authorization\\\" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.\"}],\"affected\":[{\"source\":\"security@hashicorp.com\",\"affectedData\":[{\"vendor\":\"HashiCorp\",\"product\":\"Vault\",\"defaultStatus\":\"unaffected\",\"platforms\":[\"64 bit\",\"32 bit\",\"x86\",\"ARM\",\"MacOS\",\"Windows\",\"Linux\"],\"repo\":\"https://github.com/hashicorp/vault\",\"versions\":[{\"version\":\"0.11.2\",\"lessThan\":\"2.0.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"HashiCorp\",\"product\":\"Vault Enterprise\",\"defaultStatus\":\"unaffected\",\"platforms\":[\"64 bit\",\"32 bit\",\"x86\",\"ARM\",\"MacOS\",\"Windows\",\"Linux\"],\"repo\":\"https://github.com/hashicorp/vault\",\"versions\":[{\"version\":\"0.11.2\",\"lessThan\":\"2.0.0\",\"versionType\":\"semver\",\"status\":\"affected\",\"changes\":[{\"at\":\"1.19.16\",\"status\":\"unaffected\"},{\"at\":\"1.20.10\",\"status\":\"unaffected\"},{\"at\":\"1.21.5\",\"status\":\"unaffected\"}]}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4\",\"defaultStatus\":\"affected\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@hashicorp.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.6,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.6,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-17T13:19:26.452614Z\",\"id\":\"CVE-2026-4525\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@hashicorp.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-201\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-201\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"0.11.2\",\"versionEndExcluding\":\"1.19.16\",\"matchCriteriaId\":\"E12BA6D9-0FDE-4CA9-8D01-35CD029D15D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"0.11.2\",\"versionEndExcluding\":\"2.0.0\",\"matchCriteriaId\":\"48995D65-70D6-476A-ACD7-2A8F527D2975\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"1.20.0\",\"versionEndExcluding\":\"1.20.10\",\"matchCriteriaId\":\"E2135CCF-F6D8-41AC-8D0C-F763F63974B4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"1.21.0\",\"versionEndExcluding\":\"1.21.5\",\"matchCriteriaId\":\"C8097BD2-0B19-4BA7-930E-93A5A89EC4AF\"}]}]}],\"references\":[{\"url\":\"https://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344\",\"source\":\"security@hashicorp.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-4525\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2459107\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4525.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"Vault: Vault: Information disclosure of authentication tokens via incorrect header handling\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-04-17T04:01:24.934Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-04-17T03:00:47.561Z\", \"value\": \"Made public.\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-04-17T03:00:47.561Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-4525\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2459107\", \"name\": \"RHBZ#2459107\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4525.json\", \"tags\": [\"x_sadp-csaf-vex\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in Vault. When a Vault authentication mount is configured to pass through the \\\"Authorization\\\" header, and this header is used for authentication, Vault incorrectly forwards the sensitive Vault token to the authentication plugin backend. This can lead to the disclosure of authentication tokens to potentially untrusted or compromised backend plugins, enabling unauthorized access or further system compromise.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-201\", \"description\": \"Insertion of Sensitive Information Into Sent Data\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-06-30T03:18:58.860Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-4525\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-17T13:19:26.452614Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-17T13:19:29.212Z\"}}], \"cna\": {\"title\": \"Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header\", \"source\": {\"advisory\": \"HCSEC-2026-08\", \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"value\": \"This issue was identified and reported by Oleh Konko of 1seal.\"}], \"impacts\": [{\"capecId\": \"CAPEC-118\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-118: Collect and Analyze Information\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/hashicorp/vault\", \"vendor\": \"HashiCorp\", \"product\": \"Vault\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.11.2\", \"lessThan\": \"2.0.0\", \"versionType\": \"semver\"}], \"platforms\": [\"64 bit\", \"32 bit\", \"x86\", \"ARM\", \"MacOS\", \"Windows\", \"Linux\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://github.com/hashicorp/vault\", \"vendor\": \"HashiCorp\", \"product\": \"Vault Enterprise\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"1.19.16\", \"status\": \"unaffected\"}, {\"at\": \"1.20.10\", \"status\": \"unaffected\"}, {\"at\": \"1.21.5\", \"status\": \"unaffected\"}], \"version\": \"0.11.2\", \"lessThan\": \"2.0.0\", \"versionType\": \"semver\"}], \"platforms\": [\"64 bit\", \"32 bit\", \"x86\", \"ARM\", \"MacOS\", \"Windows\", \"Linux\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"If a Vault auth mount is configured to pass through the \\\"Authorization\\\" header, and the \\\"Authorization\\\" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIf a Vault auth mount is configured to pass through the \\\"Authorization\\\" header, and the \\\"Authorization\\\" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.\u003c/p\u003e\u003cbr/\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-201\", \"description\": \"CWE-201: Insertion of Sensitive Information Into Sent Data\"}]}], \"providerMetadata\": {\"orgId\": \"67fedba0-ff2e-4543-ba5b-aa93e87718cc\", \"shortName\": \"HashiCorp\", \"dateUpdated\": \"2026-04-17T17:22:41.255Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-4525\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-30T03:18:58.860Z\", \"dateReserved\": \"2026-03-20T17:47:40.835Z\", \"assignerOrgId\": \"67fedba0-ff2e-4543-ba5b-aa93e87718cc\", \"datePublished\": \"2026-04-17T03:00:47.561Z\", \"assignerShortName\": \"HashiCorp\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

bit-vault-2026-4525

Vulnerability from bitnami_vulndb

Published

2026-04-21 12:15

Modified

2026-07-06 06:18

Summary

Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header

Details

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "vault",
        "purl": "pkg:bitnami/vault"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.10.0"
            },
            {
              "fixed": "2.0.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-4525"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:hashicorp:vault:*:*:*:*:*:go:*:*",
      "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:go:*:*"
    ],
    "severity": "High"
  },
  "details": "If a Vault auth mount is configured to pass through the \"Authorization\" header, and the \"Authorization\" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.",
  "id": "BIT-vault-2026-4525",
  "modified": "2026-07-06T06:18:57.499Z",
  "published": "2026-04-21T12:15:54.610Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4525"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-4525"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459107"
    },
    {
      "type": "WEB",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4525.json"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header"
}

FKIE_CVE-2026-4525

Vulnerability from fkie_nvd - Published: 2026-04-17 04:16 - Updated: 2026-06-30 03:20

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security@hashicorp.com	https://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344	Vendor Advisory
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://access.redhat.com/security/cve/CVE-2026-4525
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://bugzilla.redhat.com/show_bug.cgi?id=2459107
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4525.json

Impacted products

Vendor	Product	Version
hashicorp	vault	*
hashicorp	vault	*
hashicorp	vault	*
hashicorp	vault	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "64 bit",
            "32 bit",
            "x86",
            "ARM",
            "MacOS",
            "Windows",
            "Linux"
          ],
          "product": "Vault",
          "repo": "https://github.com/hashicorp/vault",
          "vendor": "HashiCorp",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "affected",
              "version": "0.11.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "64 bit",
            "32 bit",
            "x86",
            "ARM",
            "MacOS",
            "Windows",
            "Linux"
          ],
          "product": "Vault Enterprise",
          "repo": "https://github.com/hashicorp/vault",
          "vendor": "HashiCorp",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.19.16",
                  "status": "unaffected"
                },
                {
                  "at": "1.20.10",
                  "status": "unaffected"
                },
                {
                  "at": "1.21.5",
                  "status": "unaffected"
                }
              ],
              "lessThan": "2.0.0",
              "status": "affected",
              "version": "0.11.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@hashicorp.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:/a:redhat:openshift_data_foundation:4"
          ],
          "defaultStatus": "affected",
          "product": "Red Hat Openshift Data Foundation 4",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "E12BA6D9-0FDE-4CA9-8D01-35CD029D15D2",
              "versionEndExcluding": "1.19.16",
              "versionStartIncluding": "0.11.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
              "matchCriteriaId": "48995D65-70D6-476A-ACD7-2A8F527D2975",
              "versionEndExcluding": "2.0.0",
              "versionStartIncluding": "0.11.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "E2135CCF-F6D8-41AC-8D0C-F763F63974B4",
              "versionEndExcluding": "1.20.10",
              "versionStartIncluding": "1.20.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "C8097BD2-0B19-4BA7-930E-93A5A89EC4AF",
              "versionEndExcluding": "1.21.5",
              "versionStartIncluding": "1.21.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "If a Vault auth mount is configured to pass through the \"Authorization\" header, and the \"Authorization\" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16."
    }
  ],
  "id": "CVE-2026-4525",
  "lastModified": "2026-06-30T03:20:34.070",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9,
        "source": "security@hashicorp.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9,
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-4525",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-17T13:19:26.452614Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-17T04:16:09.997",
  "references": [
    {
      "source": "security@hashicorp.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/security/cve/CVE-2026-4525"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459107"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4525.json"
    }
  ],
  "sourceIdentifier": "security@hashicorp.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-201"
        }
      ],
      "source": "security@hashicorp.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-201"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "type": "Secondary"
    }
  ]
}

GHSA-72GW-FMMR-C4R4

Vulnerability from github – Published: 2026-04-17 06:31 – Updated: 2026-04-18 00:53

Summary

HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization

Details

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/hashicorp/vault"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.11.2"
            },
            {
              "last_affected": "1.21.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-4525"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-201"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-18T00:53:01Z",
    "nvd_published_at": "2026-04-17T04:16:09Z",
    "severity": "HIGH"
  },
  "details": "If a Vault auth mount is configured to pass through the \"Authorization\" header, and the \"Authorization\" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.",
  "id": "GHSA-72gw-fmmr-c4r4",
  "modified": "2026-04-18T00:53:01Z",
  "published": "2026-04-17T06:31:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4525"
    },
    {
      "type": "WEB",
      "url": "https://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/hashicorp/vault"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization"
}

WID-SEC-W-2026-1164

Vulnerability from csaf_certbund - Published: 2026-04-16 22:00 - Updated: 2026-04-16 22:00

Summary

Hashicorp Vault Community Edition und Enterprise: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Vault ist ein identitätsbasiertes System zur Verwaltung von Geheimnissen und Verschlüsselung.

Angriff: Ein Angreifer kann mehrere Schwachstellen in Hashicorp Vault ausnutzen, um Daten zu manipulieren, einen Denial-of-Service-Zustand zu verursachen oder vertrauliche Informationen offenzulegen, was möglicherweise eine Privilegienerweiterung ermöglicht.

Betroffene Betriebssysteme: - Sonstiges - UNIX

CVE-2026-3605

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
Hashicorp Vault Enterprise <2.0.0 Hashicorp / Vault		Enterprise <2.0.0
Hashicorp Vault Community Edition <2.0.0 Hashicorp / Vault		Community Edition <2.0.0
Hashicorp Vault Enterprise <1.20.10 Hashicorp / Vault		Enterprise <1.20.10
Hashicorp Vault Enterprise <1.19.16 Hashicorp / Vault		Enterprise <1.19.16
Hashicorp Vault Enterprise <1.21.5 Hashicorp / Vault		Enterprise <1.21.5

CVE-2026-4525

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
Hashicorp Vault Enterprise <2.0.0 Hashicorp / Vault		Enterprise <2.0.0
Hashicorp Vault Community Edition <2.0.0 Hashicorp / Vault		Community Edition <2.0.0
Hashicorp Vault Enterprise <1.20.10 Hashicorp / Vault		Enterprise <1.20.10
Hashicorp Vault Enterprise <1.19.16 Hashicorp / Vault		Enterprise <1.19.16
Hashicorp Vault Enterprise <1.21.5 Hashicorp / Vault		Enterprise <1.21.5

CVE-2026-5052

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
Hashicorp Vault Enterprise <2.0.0 Hashicorp / Vault		Enterprise <2.0.0
Hashicorp Vault Community Edition <2.0.0 Hashicorp / Vault		Community Edition <2.0.0
Hashicorp Vault Enterprise <1.20.10 Hashicorp / Vault		Enterprise <1.20.10
Hashicorp Vault Enterprise <1.19.16 Hashicorp / Vault		Enterprise <1.19.16
Hashicorp Vault Enterprise <1.21.5 Hashicorp / Vault		Enterprise <1.21.5

CVE-2026-5807

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
Hashicorp Vault Enterprise <2.0.0 Hashicorp / Vault		Enterprise <2.0.0
Hashicorp Vault Community Edition <2.0.0 Hashicorp / Vault		Community Edition <2.0.0
Hashicorp Vault Enterprise <1.20.10 Hashicorp / Vault		Enterprise <1.20.10
Hashicorp Vault Enterprise <1.19.16 Hashicorp / Vault		Enterprise <1.19.16
Hashicorp Vault Enterprise <1.21.5 Hashicorp / Vault		Enterprise <1.21.5

References

6 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://discuss.hashicorp.com/t/hcsec-2026-05-vau…	external
https://discuss.hashicorp.com/t/hcsec-2026-06-vau…	external
https://discuss.hashicorp.com/t/hcsec-2026-07-vau…	external
https://discuss.hashicorp.com/t/hcsec-2026-08-vau…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Vault ist ein identit\u00e4tsbasiertes System zur Verwaltung von Geheimnissen und Verschl\u00fcsselung.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Hashicorp Vault ausnutzen, um Daten zu manipulieren, einen Denial-of-Service-Zustand zu verursachen oder vertrauliche Informationen offenzulegen, was m\u00f6glicherweise eine Privilegienerweiterung erm\u00f6glicht.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1164 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1164.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1164 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1164"
      },
      {
        "category": "external",
        "summary": "Hashicorp Security Advisory vom 2026-04-16",
        "url": "https://discuss.hashicorp.com/t/hcsec-2026-05-vault-kvv2-metadata-and-secret-deletion-policy-bypass-denial-of-service/77342"
      },
      {
        "category": "external",
        "summary": "Hashicorp Security Advisory vom 2026-04-16",
        "url": "https://discuss.hashicorp.com/t/hcsec-2026-06-vault-vulnerable-to-server-side-request-forgery-in-acme-challenge-validation-via-attacker-controlled-dns/77343"
      },
      {
        "category": "external",
        "summary": "Hashicorp Security Advisory vom 2026-04-16",
        "url": "https://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344"
      },
      {
        "category": "external",
        "summary": "Hashicorp Security Advisory vom 2026-04-16",
        "url": "https://discuss.hashicorp.com/t/hcsec-2026-08-vault-vulnerable-to-denial-of-service-via-unauthenticated-root-token-generation-rekey-operations/77345"
      }
    ],
    "source_lang": "en-US",
    "title": "Hashicorp Vault Community Edition und Enterprise: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-04-16T22:00:00.000+00:00",
      "generator": {
        "date": "2026-04-17T09:44:17.338+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-1164",
      "initial_release_date": "2026-04-16T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-04-16T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Community Edition \u003c2.0.0",
                "product": {
                  "name": "Hashicorp Vault Community Edition \u003c2.0.0",
                  "product_id": "T052945"
                }
              },
              {
                "category": "product_version",
                "name": "Community Edition 2.0.0",
                "product": {
                  "name": "Hashicorp Vault Community Edition 2.0.0",
                  "product_id": "T052945-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hashicorp:vault:community_edition__2.0.0"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Enterprise \u003c2.0.0",
                "product": {
                  "name": "Hashicorp Vault Enterprise \u003c2.0.0",
                  "product_id": "T052949"
                }
              },
              {
                "category": "product_version",
                "name": "Enterprise 2.0.0",
                "product": {
                  "name": "Hashicorp Vault Enterprise 2.0.0",
                  "product_id": "T052949-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hashicorp:vault:enterprise__2.0.0"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Enterprise \u003c1.21.5",
                "product": {
                  "name": "Hashicorp Vault Enterprise \u003c1.21.5",
                  "product_id": "T052950"
                }
              },
              {
                "category": "product_version",
                "name": "Enterprise 1.21.5",
                "product": {
                  "name": "Hashicorp Vault Enterprise 1.21.5",
                  "product_id": "T052950-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hashicorp:vault:enterprise__1.21.5"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Enterprise \u003c1.20.10",
                "product": {
                  "name": "Hashicorp Vault Enterprise \u003c1.20.10",
                  "product_id": "T052951"
                }
              },
              {
                "category": "product_version",
                "name": "Enterprise 1.20.10",
                "product": {
                  "name": "Hashicorp Vault Enterprise 1.20.10",
                  "product_id": "T052951-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hashicorp:vault:enterprise__1.20.10"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Enterprise \u003c1.19.16",
                "product": {
                  "name": "Hashicorp Vault Enterprise \u003c1.19.16",
                  "product_id": "T052952"
                }
              },
              {
                "category": "product_version",
                "name": "Enterprise 1.19.16",
                "product": {
                  "name": "Hashicorp Vault Enterprise 1.19.16",
                  "product_id": "T052952-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hashicorp:vault:enterprise__1.19.16"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Vault"
          }
        ],
        "category": "vendor",
        "name": "Hashicorp"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-3605",
      "product_status": {
        "known_affected": [
          "T052949",
          "T052945",
          "T052951",
          "T052952",
          "T052950"
        ]
      },
      "release_date": "2026-04-16T22:00:00.000+00:00",
      "title": "CVE-2026-3605"
    },
    {
      "cve": "CVE-2026-4525",
      "product_status": {
        "known_affected": [
          "T052949",
          "T052945",
          "T052951",
          "T052952",
          "T052950"
        ]
      },
      "release_date": "2026-04-16T22:00:00.000+00:00",
      "title": "CVE-2026-4525"
    },
    {
      "cve": "CVE-2026-5052",
      "product_status": {
        "known_affected": [
          "T052949",
          "T052945",
          "T052951",
          "T052952",
          "T052950"
        ]
      },
      "release_date": "2026-04-16T22:00:00.000+00:00",
      "title": "CVE-2026-5052"
    },
    {
      "cve": "CVE-2026-5807",
      "product_status": {
        "known_affected": [
          "T052949",
          "T052945",
          "T052951",
          "T052952",
          "T052950"
        ]
      },
      "release_date": "2026-04-16T22:00:00.000+00:00",
      "title": "CVE-2026-5807"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-4525 (GCVE-0-2026-4525)

bit-vault-2026-4525

Vulnerability from bitnami_vulndb

FKIE_CVE-2026-4525

GHSA-72GW-FMMR-C4R4

WID-SEC-W-2026-1164

Tags

Sightings

Nomenclature