# Security **URL:** https://discuss.hashicorp.com/c/security/52.md [Latest](https://discuss.hashicorp.com/latest.md) · [Categories](https://discuss.hashicorp.com/categories.md) · [Tags](https://discuss.hashicorp.com/tags.md) --- ## [About HashiCorp security updates](https://discuss.hashicorp.com/t/about-hashicorp-security-updates/15330)
**Author:** [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\ **Replies:** 0
Security updates for all HashiCorp products and services. Posting to this category is restricted to HashiCorp employees only. Reporting Security Vulnerabilities We deeply appreciate any effort to discover and coordina… --- ## [HCSEC-2026-45 - Updates to HashiCorp subprocessors](https://discuss.hashicorp.com/t/hcsec-2026-45-updates-to-hashicorp-subprocessors/77833)
**Author:** [@mariajosep.lopez](https://discuss.hashicorp.com/u/mariajosep.lopez)\ **Replies:** 0\ **Last updated:** [October 13, 2026, 9:39am UTC](https://discuss.hashicorp.com/t/hcsec-2026-45-updates-to-hashicorp-subprocessors/77833 "2026-10-13T09:39:42Z")
Bulletin ID: HCSEC-2026-45 Publication Date: October 13, 2026 Summary As part of HashiCorp’s ongoing commitment to privacy and transparency, we have updated our subprocessors list. These updates include details about … --- ## [HCSEC-2026-44 - Go-getter vulnerable to a path traversal in S3/GCS directory download handling](https://discuss.hashicorp.com/t/hcsec-2026-44-go-getter-vulnerable-to-a-path-traversal-in-s3-gcs-directory-download-handling/77819)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [October 8, 2026, 3:16pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-44-go-getter-vulnerable-to-a-path-traversal-in-s3-gcs-directory-download-handling/77819 "2026-10-08T15:16:21Z")
Bulletin ID: HCSEC-2026-44 Affected Products / Versions: Go-getter up to 1.8.9 and 2.2.4; fixed in go-getter 1.8.10 and 2.2.5 Publication Date: October 8, 2026 Summary HashiCorp go-getter versions before 1.8.10 and g… --- ## [HCSEC-2026-43 - Vault Inconsistent ACL Policy Evaluation May Allow Bypass of Deny Restrictions](https://discuss.hashicorp.com/t/hcsec-2026-43-vault-inconsistent-acl-policy-evaluation-may-allow-bypass-of-deny-restrictions/77815)
**Author:** [@mariajosep.lopez](https://discuss.hashicorp.com/u/mariajosep.lopez)\ **Replies:** 0\ **Last updated:** [October 7, 2026, 10:00pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-43-vault-inconsistent-acl-policy-evaluation-may-allow-bypass-of-deny-restrictions/77815 "2026-10-07T22:00:11Z")
Bulletin ID: HCSEC-2026-43 Affected Products / Versions: Vault Community Edition up to 2.1.1; fixed in Vault Community Edition 2.1.2. Vault Enterprise up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and … --- ## [HCSEC-2026-42 - Vault Enterprise ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution](https://discuss.hashicorp.com/t/hcsec-2026-42-vault-enterprise-acl-policy-cache-vulnerable-to-cross-namespace-policy-resolution/77814)
**Author:** [@mariajosep.lopez](https://discuss.hashicorp.com/u/mariajosep.lopez)\ **Replies:** 0\ **Last updated:** [October 7, 2026, 9:46pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-42-vault-enterprise-acl-policy-cache-vulnerable-to-cross-namespace-policy-resolution/77814 "2026-10-07T21:46:47Z")
Bulletin ID: HCSEC-2026-42 Affected Products / Versions: Vault Enterprise up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Publication Date: October 7, 2026 Summary Vault’s ACL policy cach… --- ## [HCSEC-2026-41 - Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots](https://discuss.hashicorp.com/t/hcsec-2026-41-vault-vulnerable-to-arbitrary-code-execution-via-plugin-catalog-entries-restored-from-raft-snapshots/77813)
**Author:** [@mariajosep.lopez](https://discuss.hashicorp.com/u/mariajosep.lopez)\ **Replies:** 0\ **Last updated:** [October 7, 2026, 9:34pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-41-vault-vulnerable-to-arbitrary-code-execution-via-plugin-catalog-entries-restored-from-raft-snapshots/77813 "2026-10-07T21:34:25Z")
Bulletin ID: HCSEC-2026-41 Affected Products / Versions: Vault Community Edition and Vault Enterprise up to 2.1.1; fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Publ… --- ## [HCSEC-2026-40 - Vault PKI ACME Default Directory Policy May Issue Certificates With Unverified Identities](https://discuss.hashicorp.com/t/hcsec-2026-40-vault-pki-acme-default-directory-policy-may-issue-certificates-with-unverified-identities/77812)
**Author:** [@mariajosep.lopez](https://discuss.hashicorp.com/u/mariajosep.lopez)\ **Replies:** 0\ **Last updated:** [October 7, 2026, 9:18pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-40-vault-pki-acme-default-directory-policy-may-issue-certificates-with-unverified-identities/77812 "2026-10-07T21:18:47Z")
Bulletin ID: HCSEC-2026-40 Affected Products / Versions: Vault Community Edition 1.14.0 up to 2.1.1; fixed in Vault Community Edition 2.1.2. Vault Enterprise 1.14.0 up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12,… --- ## [HCSEC-2026-39 - Go-getter vulnerable to a privilege escalation issue in its archive decompression handling](https://discuss.hashicorp.com/t/hcsec-2026-39-go-getter-vulnerable-to-a-privilege-escalation-issue-in-its-archive-decompression-handling/77752)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [September 15, 2026, 7:42pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-39-go-getter-vulnerable-to-a-privilege-escalation-issue-in-its-archive-decompression-handling/77752 "2026-09-15T19:42:56Z")
Bulletin ID: HCSEC-2026-39 Affected Products / Versions: Go-getter up to 1.8.8 and 2.2.3; fixed in go-getter 1.8.9 and 2.2.4 Publication Date: September 15, 2026 Summary The go-getter library up to versions 1.8.8 and… --- ## [HCSEC-2026-38 - Consul-template vulnerable to an information disclosure issue in error handling](https://discuss.hashicorp.com/t/hcsec-2026-38-consul-template-vulnerable-to-an-information-disclosure-issue-in-error-handling/77740)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [September 10, 2026, 6:51pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-38-consul-template-vulnerable-to-an-information-disclosure-issue-in-error-handling/77740 "2026-09-10T18:51:37Z")
Bulletin ID: HCSEC-2026-38 Affected Products / Versions: consul-template 0.27.2 through 0.42.1; fixed in consul-template 0.43.0 Publication Date: September 10, 2026 Summary The consul-template library is vulnerable t… --- ## [HCSEC-2026-37 - Consul vulnerable to an authorization bypass in the Connect service mesh](https://discuss.hashicorp.com/t/hcsec-2026-37-consul-vulnerable-to-an-authorization-bypass-in-the-connect-service-mesh/77739)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [September 10, 2026, 6:49pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-37-consul-vulnerable-to-an-authorization-bypass-in-the-connect-service-mesh/77739 "2026-09-10T18:49:49Z")
Bulletin ID: HCSEC-2026-37 Affected Products / Versions: Consul and Consul Enterprise 1.9.0 through 2.0.3; fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4. Publication Date: September 10, 2026 S… --- ## [HCSEC-2026-36 - Consul vulnerable to an authorization bypass in the catalog deregistration path](https://discuss.hashicorp.com/t/hcsec-2026-36-consul-vulnerable-to-an-authorization-bypass-in-the-catalog-deregistration-path/77738)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [September 10, 2026, 6:47pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-36-consul-vulnerable-to-an-authorization-bypass-in-the-catalog-deregistration-path/77738 "2026-09-10T18:47:55Z")
Bulletin ID: HCSEC-2026-36 Affected Products / Versions: Consul and Consul Enterprise 1.21.0 through 2.0.3; fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4. Publication Date: September 10, 2026 … --- ## [HCSEC-2026-35 - Consul vulnerable to a denial of service in the native RPC listener](https://discuss.hashicorp.com/t/hcsec-2026-35-consul-vulnerable-to-a-denial-of-service-in-the-native-rpc-listener/77737)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [September 10, 2026, 6:46pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-35-consul-vulnerable-to-a-denial-of-service-in-the-native-rpc-listener/77737 "2026-09-10T18:46:33Z")
Bulletin ID: HCSEC-2026-35 Affected Products / Versions: Consul and Consul Enterprise 1.21.0 through 2.0.3; fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4. Publication Date: September 10, 2026 … --- ## [HCSEC-2026-34 - Consul vulnerable to an authorization bypass in the catalog node-write path](https://discuss.hashicorp.com/t/hcsec-2026-34-consul-vulnerable-to-an-authorization-bypass-in-the-catalog-node-write-path/77736)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [September 10, 2026, 6:45pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-34-consul-vulnerable-to-an-authorization-bypass-in-the-catalog-node-write-path/77736 "2026-09-10T18:45:04Z")
Bulletin ID: HCSEC-2026-34 Affected Products / Versions: Consul and Consul Enterprise up to 2.0.3; fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4. Publication Date: September 10, 2026 Summary … --- ## [HCSEC-2026-33 - HashiCorp Linux Signing GPG Key Update (CA026560)](https://discuss.hashicorp.com/t/hcsec-2026-33-hashicorp-linux-signing-gpg-key-update-ca026560/77734)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [September 10, 2026, 2:39pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-33-hashicorp-linux-signing-gpg-key-update-ca026560/77734 "2026-09-10T14:39:04Z")
Bulletin ID: HCSEC-2026-33 Publication Date: September 10, 2026 Last Updated: September 11, 2026 Summary Action is required for customers who install HashiCorp software via our Linux APT or RPM repositories. The Has… --- ## [HCSEC-2026-32 - Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths](https://discuss.hashicorp.com/t/hcsec-2026-32-vault-vulnerable-to-privilege-escalation-via-slash-injection-in-templated-policy-paths/77678)
**Author:** [@mark.collao](https://discuss.hashicorp.com/u/mark.collao)\ **Replies:** 0\ **Last updated:** [August 24, 2026, 8:40pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-32-vault-vulnerable-to-privilege-escalation-via-slash-injection-in-templated-policy-paths/77678 "2026-08-24T20:40:55Z")
Bulletin ID: HCSEC-2026-32 Affected Products / Versions: Vault Community Edition from 0.11.0 up to 2.0.3; fixed in 2.0.4. Vault Enterprise from 0.11.0 up to 2.0.3, 1.21.8, 1.20.13, and 1.19.19; fixed in 2.0.4, 1.21.9,… --- ## [HCSEC-2026-31 - Go-slug vulnerable to exclusion bypass in .terraformignore handling](https://discuss.hashicorp.com/t/hcsec-2026-31-go-slug-vulnerable-to-exclusion-bypass-in-terraformignore-handling/77668)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [August 20, 2026, 7:40pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-31-go-slug-vulnerable-to-exclusion-bypass-in-terraformignore-handling/77668 "2026-08-20T19:40:14Z")
Bulletin ID: HCSEC-2026-31 Affected Products / Versions: github.com/hashicorp/go-slug v0.4.0 through v0.18.2; fixed in v0.18.3. Publication Date: August 20, 2026 Summary The github.com/hashicorp/go-slug library befor… --- ## [HCSEC-2026-30 - Updates to HashiCorp subprocessors](https://discuss.hashicorp.com/t/hcsec-2026-30-updates-to-hashicorp-subprocessors/77657)
**Author:** [@mariajosep.lopez](https://discuss.hashicorp.com/u/mariajosep.lopez)\ **Replies:** 0\ **Last updated:** [August 18, 2026, 8:41am UTC](https://discuss.hashicorp.com/t/hcsec-2026-30-updates-to-hashicorp-subprocessors/77657 "2026-08-18T08:41:48Z")
Bulletin ID: HCSEC-2026-30 Publication Date: August 18, 2026 Summary As part of HashiCorp’s ongoing commitment to privacy and transparency, we have updated our subprocessors list. These updates include details about t… --- ## [HCSEC-2026-29 - Packer vulnerable to arbitrary file write via crafted plugin archive during installation](https://discuss.hashicorp.com/t/hcsec-2026-29-packer-vulnerable-to-arbitrary-file-write-via-crafted-plugin-archive-during-installation/77654)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [August 17, 2026, 8:20pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-29-packer-vulnerable-to-arbitrary-file-write-via-crafted-plugin-archive-during-installation/77654 "2026-08-17T20:20:56Z")
Bulletin ID: HCSEC-2026-29 Affected Products / Versions: Packer 1.7.0 up to 1.15.4; fixed in Packer 1.16.0 Publication Date: August 17, 2026 Summary Packer up to 1.15.4 is vulnerable to an issue in the third-party pl… --- ## [HCSEC-2026-28 - Vault Secrets Operator vulnerable to arbitrary file read via AppRole secretIDPath](https://discuss.hashicorp.com/t/hcsec-2026-28-vault-secrets-operator-vulnerable-to-arbitrary-file-read-via-approle-secretidpath/77645)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 8:26pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-28-vault-secrets-operator-vulnerable-to-arbitrary-file-read-via-approle-secretidpath/77645 "2026-08-13T20:26:10Z")
Bulletin ID: HCSEC-2026-28 Affected Products / Versions: Vault Secrets Operator 1.3.0 up to 1.4.1; fixed in Vault Secrets Operator 1.5.0. Publication Date: August 13, 2026 Summary Vault Secrets Operator 1.3.0 up to 1… --- ## [HCSEC-2026-27 - Vault Enterprise vulnerable to cross-namespace entity deletion](https://discuss.hashicorp.com/t/hcsec-2026-27-vault-enterprise-vulnerable-to-cross-namespace-entity-deletion/77634)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [August 10, 2026, 5:08pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-27-vault-enterprise-vulnerable-to-cross-namespace-entity-deletion/77634 "2026-08-10T17:08:20Z")
Bulletin ID: HCSEC-2026-27 Affected Products / Versions: Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16 LTS, up to 2.0.3, 1.21.8, 1.20.13, and 1.19.19 LTS; fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19… --- ## [HCSEC-2026-26 - Vault vulnerable to LIST authorization bypass via trailing-slash strip](https://discuss.hashicorp.com/t/hcsec-2026-26-vault-vulnerable-to-list-authorization-bypass-via-trailing-slash-strip/77632)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [August 10, 2026, 4:57pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-26-vault-vulnerable-to-list-authorization-bypass-via-trailing-slash-strip/77632 "2026-08-10T16:57:00Z")
Bulletin ID: HCSEC-2026-26 Affected Products / Versions: Vault and Vault Enterprise up to 2.0.2; fixed in Vault 2.0.3 and Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19 Publication Date: August 10, 2026 Summary … --- ## [HCSEC-2026-25 - Multiple vulnerabilities impacting HashiCorp Consul](https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629)
**Author:** [@mary.dubard](https://discuss.hashicorp.com/u/mary.dubard)\ **Replies:** 0\ **Last updated:** [August 7, 2026, 7:01pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629 "2026-08-07T19:01:38Z")
Bulletin ID: HCSEC-2026-25 Affected Products / Versions: CVE-2026-19012: Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2. CVE-2026-19014: Consul Community Edition and Consul Enterprise 1.17.0 t… --- ## [HCSEC-2026-24 - Multiple vulnerabilities impacting HashiCorp Consul MCP Server](https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612)
**Author:** [@mary.dubard](https://discuss.hashicorp.com/u/mary.dubard)\ **Replies:** 0\ **Last updated:** [July 29, 2026, 6:24pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-24-multiple-vulnerabilities-impacting-hashicorp-consul-mcp-server/77612 "2026-07-29T18:24:41Z")
Bulletin ID: HCSEC-2026-24 Affected Products / Versions: consul-mcp-server 0.1.0 up to 0.1.3; fixed in 0.1.4. Publication Date: July 29, 2026 Summary consul-mcp-server versions 0.1.0 up to 0.1.3 are affected by two v… --- ## [HCSEC-2026-23 - Multiple vulnerabilities impacting HashiCorp Terraform MCP Server](https://discuss.hashicorp.com/t/hcsec-2026-23-multiple-vulnerabilities-impacting-hashicorp-terraform-mcp-server/77606)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [July 28, 2026, 5:50pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-23-multiple-vulnerabilities-impacting-hashicorp-terraform-mcp-server/77606 "2026-07-28T17:50:43Z")
Bulletin ID: HCSEC-2026-23 Affected Products / Versions: terraform-mcp-server 0.2.1 up to and including 1.0.0; fixed in 1.1.0. Publication Date: July 28, 2026 Summary The terraform-mcp-server before version 1.1.0 is … --- ## [HCSEC-2026-22 - Nomad vulnerable to cross-namespace host volume claim deletion](https://discuss.hashicorp.com/t/hcsec-2026-22-nomad-vulnerable-to-cross-namespace-host-volume-claim-deletion/77562)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [July 8, 2026, 8:18pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-22-nomad-vulnerable-to-cross-namespace-host-volume-claim-deletion/77562 "2026-07-08T20:18:59Z")
Bulletin ID: HCSEC-2026-22 Affected Products / Versions: Nomad and Nomad Enterprise up to 2.0.3; fixed in Nomad 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14. Publication Date: July 8, 2026 Summary HashiCorp … --- ## [HCSEC-2026-21 - Nomad vulnerable to sandbox escape in Docker task driver](https://discuss.hashicorp.com/t/hcsec-2026-21-nomad-vulnerable-to-sandbox-escape-in-docker-task-driver/77561)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [July 8, 2026, 8:07pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-21-nomad-vulnerable-to-sandbox-escape-in-docker-task-driver/77561 "2026-07-08T20:07:31Z")
Bulletin ID: HCSEC-2026-21 Affected Products / Versions: Nomad and Nomad Enterprise up to 2.0.3; fixed in Nomad 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14. Publication Date: July 8, 2026 Summary HashiCorp … --- ## [HCSEC-2026-20 - Consul-template vulnerable to path redirections in writeToFile](https://discuss.hashicorp.com/t/hcsec-2026-20-consul-template-vulnerable-to-path-redirections-in-writetofile/77559)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [July 8, 2026, 5:41pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-20-consul-template-vulnerable-to-path-redirections-in-writetofile/77559 "2026-07-08T17:41:30Z")
Bulletin ID: HCSEC-2026-20 Affected Products / Versions: Consul-template up to and including 0.42.0; fixed in 0.42.1. Publication Date: July 8, 2026 Summary The consul-template library before version 0.42.1 is vulner… --- ## [HCSEC-2026-19 - Nomad Docker driver vulnerable to host namespace bypass on Linux](https://discuss.hashicorp.com/t/hcsec-2026-19-nomad-docker-driver-vulnerable-to-host-namespace-bypass-on-linux/77557)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [July 8, 2026, 5:26pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-19-nomad-docker-driver-vulnerable-to-host-namespace-bypass-on-linux/77557 "2026-07-08T17:26:12Z")
Bulletin ID: HCSEC-2026-19 Affected Products / Versions: Nomad and Nomad Enterprise up to 2.0.3; fixed in Nomad 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14. Publication Date: July 8, 2026 Summary HashiCorp … --- ## [HCSEC-2026-18 - Memberlist vulnerable to denial of service via gossip message](https://discuss.hashicorp.com/t/hcsec-2026-18-memberlist-vulnerable-to-denial-of-service-via-gossip-message/77556)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [July 8, 2026, 5:12pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-18-memberlist-vulnerable-to-denial-of-service-via-gossip-message/77556 "2026-07-08T17:12:28Z")
Bulletin ID: HCSEC-2026-18 Affected Products / Versions: memberlist up to 0.5.4; fixed in 0.6.0. Publication Date: July 8, 2026 Summary HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service i… --- ## [HCSEC-2026-17 - Terraform Enterprise vulnerable to arbitrary file read](https://discuss.hashicorp.com/t/hcsec-2026-17-terraform-enterprise-vulnerable-to-arbitrary-file-read/77549)
**Author:** [@james.warren](https://discuss.hashicorp.com/u/james.warren)\ **Replies:** 0\ **Last updated:** [July 6, 2026, 8:55pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-17-terraform-enterprise-vulnerable-to-arbitrary-file-read/77549 "2026-07-06T20:55:01Z")
Bulletin ID: HCSEC-2026-17 Affected Products / Versions: Terraform Enterprise v202506-1, v202507-1, and 1.0.0 through 2.0.3; fixed in Terraform Enterprise 2.0.4, 1.2.4. Publication Date: July 6, 2026 Summary HashiCor… [Next page](https://discuss.hashicorp.com/c/security/52.md?page=1)