{"post_stream":{"posts":[{"id":148117,"username":"james.warren","avatar_template":"/user_avatar/discuss.hashicorp.com/james.warren/{size}/44042_2.png","created_at":"2026-11-12T22:26:40.460Z","cooked":"\u003cp\u003e\u003cstrong\u003eBulletin ID:\u003c/strong\u003e HCSEC-2026-55\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eAffected Products / Versions:\u003c/strong\u003e Vault and Vault Enterprise up to 2.2.1; fixed in Vault 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003ePublication Date:\u003c/strong\u003e November 12, 2026\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eSummary\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eHashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow an unauthenticated attacker with network access to a new, uninitialized node to cause that node to send credentials from its server environment to an attacker-controlled server. This vulnerability (CVE-2026-92735) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eBackground\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eVault’s integrated storage lets a new node join an existing cluster by contacting a leader node, either at an address supplied by an operator or through cloud auto-join, which discovers leader nodes using a cloud provider’s API. Because a new node has not yet been initialized, the join API on that node does not require authentication. Cloud auto-join can authenticate to the cloud provider using credentials available in the Vault server’s environment, which are intended to be sent only to the cloud provider endpoints an operator has configured.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eDetails\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eVault’s join API accepted cloud auto-join discovery settings supplied in an unauthenticated request. For discovery providers that allow the provider API endpoint to be specified and that read credentials from the server environment, an attacker could direct the node to send those credentials to a server under the attacker’s control. In addition, when contacting a leader node specified in a join request, Vault included any Vault token, and in Vault 1.18.0 and later any custom headers, configured through the \u003ccode\u003eVAULT_TOKEN\u003c/code\u003e and \u003ccode\u003eVAULT_HEADERS\u003c/code\u003e environment variables of the Vault server process. The issue requires network access to the API listener of a node that uses integrated storage and has not yet been initialized, but does not require authentication. Exposure depends on such credentials being present in the Vault server’s environment. Initialized nodes, and nodes that use integrated storage only for high availability, are not affected.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eRemediation\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eCustomers should evaluate the risk associated with this issue and consider upgrading to Vault Community Edition 2.2.2 or Vault Enterprise 2.2.2, 1.21.14, or 1.19.25. After upgrading, the join API and the \u003ccode\u003evault operator raft join\u003c/code\u003e command no longer accept cloud auto-join settings, so operators who rely on them should configure cloud auto-join using the \u003ccode\u003eretry_join\u003c/code\u003e stanza in the integrated storage configuration. Restricting network access to the API listener of new Vault nodes until they have joined a cluster reduces exposure to this issue.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eAcknowledgement\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThis issue was reported to HashiCorp by Tal Vaknin, Independent Security Researcher.\u003c/p\u003e\n\u003cp\u003e\u003cem\u003eWe deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see \u003ca href=\"https://hashicorp.com/security\"\u003ehttps://hashicorp.com/security\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e","post_number":1,"post_type":1,"posts_count":1,"updated_at":"2026-11-12T22:26:40.460Z","reply_count":0,"reply_to_post_number":null,"quote_count":0,"incoming_link_count":21,"reads":4,"readers_count":3,"score":95.8,"yours":false,"topic_id":78198,"topic_slug":"hcsec-2026-55-vault-integrated-storage-join-may-disclose-server-environment-credentials","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":1,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"link_counts":[{"url":"https://hashicorp.com/security","internal":false,"reflection":false,"clicks":0}],"read":true,"user_title":null,"bookmarked":false,"actions_summary":[],"moderator":true,"admin":false,"staff":true,"user_id":35937,"hidden":false,"trust_level":4,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false,"post_url":"/t/hcsec-2026-55-vault-integrated-storage-join-may-disclose-server-environment-credentials/78198/1","reactions":[],"current_user_reaction":null,"reaction_users_count":0,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null,"can_vote":false}],"stream":[148117]},"timeline_lookup":[[1,2]],"suggested_topics":[],"tags":[{"id":75,"name":"security-vault","slug":"security-vault"}],"tags_descriptions":{},"fancy_title":"HCSEC-2026-55 - Vault integrated storage join may disclose server environment credentials","id":78198,"title":"HCSEC-2026-55 - Vault integrated storage join may disclose server environment credentials","posts_count":1,"created_at":"2026-11-12T22:26:40.373Z","views":106,"reply_count":0,"like_count":0,"last_posted_at":"2026-11-12T22:26:40.460Z","visible":true,"closed":false,"archived":false,"has_summary":false,"archetype":"regular","slug":"hcsec-2026-55-vault-integrated-storage-join-may-disclose-server-environment-credentials","category_id":52,"word_count":499,"deleted_at":null,"user_id":35937,"featured_link":null,"pinned_globally":false,"pinned_at":null,"pinned_until":null,"image_url":null,"slow_mode_seconds":0,"draft":null,"draft_key":"topic_78198","draft_sequence":null,"unpinned":null,"pinned":false,"current_post_number":1,"highest_post_number":1,"deleted_by":null,"actions_summary":[{"id":4,"count":0,"hidden":false,"can_act":false},{"id":8,"count":0,"hidden":false,"can_act":false},{"id":10,"count":0,"hidden":false,"can_act":false},{"id":7,"count":0,"hidden":false,"can_act":false}],"chunk_size":20,"bookmarked":false,"topic_timer":null,"message_bus_last_id":338,"participant_count":1,"show_read_indicator":false,"thumbnails":null,"slow_mode_enabled_until":null,"board_memberships":[],"related_topics":[{"fancy_title":"HCSEC-2022-15 - Vault Enterprise Does Not Verify Existing Voter Status When Joining An Integrated Storage HA Node","id":42420,"title":"HCSEC-2022-15 - Vault Enterprise Does Not Verify Existing Voter Status When Joining An Integrated Storage HA Node","slug":"hcsec-2022-15-vault-enterprise-does-not-verify-existing-voter-status-when-joining-an-integrated-storage-ha-node","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2022-07-26T00:39:12.764Z","last_posted_at":"2022-07-26T00:39:12.846Z","bumped":true,"bumped_at":"2022-07-26T00:39:12.846Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[{"id":75,"name":"security-vault","slug":"security-vault"}],"tags_descriptions":{},"like_count":1,"views":8442,"category_id":52,"featured_link":null,"op_like_count":1,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user":{"id":2210,"username":"jfinnigan","avatar_template":"/user_avatar/discuss.hashicorp.com/jfinnigan/{size}/3834_2.png","trust_level":1}}]},{"fancy_title":"[ANN] Vault 1.6.0 Released","id":17500,"title":"[ANN] Vault 1.6.0 Released","slug":"ann-vault-1-6-0-released","posts_count":4,"reply_count":1,"highest_post_number":4,"image_url":null,"created_at":"2020-11-11T17:10:00.288Z","last_posted_at":"2020-11-17T14:35:39.371Z","bumped":true,"bumped_at":"2020-11-17T14:35:39.371Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"like_count":3,"views":599,"category_id":30,"featured_link":null,"op_like_count":2,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user":{"id":3232,"username":"mladlow","avatar_template":"/user_avatar/discuss.hashicorp.com/mladlow/{size}/5267_2.png","moderator":true,"trust_level":4}},{"extras":null,"description":"Recent Poster","user":{"id":250,"username":"shantanugadgil","avatar_template":"/user_avatar/discuss.hashicorp.com/shantanugadgil/{size}/923_2.png","trust_level":2}},{"extras":"latest","description":"Most Recent Poster","user":{"id":3892,"username":"rooftop90","avatar_template":"/user_avatar/discuss.hashicorp.com/rooftop90/{size}/6247_2.png","trust_level":2}}]},{"fancy_title":"Having trouble bringing up Vault node w/ integrated storage","id":61143,"title":"Having trouble bringing up Vault node w/ integrated storage","slug":"having-trouble-bringing-up-vault-node-w-integrated-storage","posts_count":12,"reply_count":7,"highest_post_number":12,"image_url":null,"created_at":"2023-12-22T23:13:54.428Z","last_posted_at":"2023-12-28T01:48:12.000Z","bumped":true,"bumped_at":"2023-12-28T01:48:12.000Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"like_count":2,"views":1493,"category_id":30,"featured_link":null,"op_like_count":0,"has_accepted_answer":false,"posters":[{"extras":"latest","description":"Original Poster, Most Recent Poster","user":{"id":32658,"username":"kaisers0s3","avatar_template":"/user_avatar/discuss.hashicorp.com/kaisers0s3/{size}/39635_2.png","trust_level":1}},{"extras":null,"description":"Recent Poster","user":{"id":21332,"username":"jonathanfrappier","avatar_template":"/user_avatar/discuss.hashicorp.com/jonathanfrappier/{size}/28004_2.png","trust_level":2}}]},{"fancy_title":"HCSEC-2021-33 - Vault’s KV Secrets Engine With Integrated Storage Exposed to Authenticated Denial of Service","id":33157,"title":"HCSEC-2021-33 - Vault’s KV Secrets Engine With Integrated Storage Exposed to Authenticated Denial of Service","slug":"hcsec-2021-33-vault-s-kv-secrets-engine-with-integrated-storage-exposed-to-authenticated-denial-of-service","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2021-12-14T01:18:30.055Z","last_posted_at":"2021-12-14T01:18:30.124Z","bumped":true,"bumped_at":"2021-12-22T22:45:13.759Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[{"id":75,"name":"security-vault","slug":"security-vault"}],"tags_descriptions":{},"like_count":0,"views":7167,"category_id":52,"featured_link":null,"op_like_count":0,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user":{"id":2210,"username":"jfinnigan","avatar_template":"/user_avatar/discuss.hashicorp.com/jfinnigan/{size}/3834_2.png","trust_level":1}}]},{"fancy_title":"HCSEC-2024-26 - Vault Vulnerable to Denial of Service Through Memory Exhaustion When Processing Raft Cluster Join Requests","id":71047,"title":"HCSEC-2024-26 - Vault Vulnerable to Denial of Service Through Memory Exhaustion When Processing Raft Cluster Join Requests","slug":"hcsec-2024-26-vault-vulnerable-to-denial-of-service-through-memory-exhaustion-when-processing-raft-cluster-join-requests","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2024-10-31T12:38:47.224Z","last_posted_at":"2024-10-31T12:38:47.283Z","bumped":true,"bumped_at":"2024-11-15T16:23:02.105Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[{"id":75,"name":"security-vault","slug":"security-vault"}],"tags_descriptions":{},"like_count":0,"views":1876,"category_id":52,"featured_link":null,"op_like_count":0,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user":{"id":25501,"username":"mark.collao","avatar_template":"/user_avatar/discuss.hashicorp.com/mark.collao/{size}/23944_2.png","trust_level":1}}]}],"summarizable":false,"has_cached_summary":false,"valid_reactions":["heart","+1","laughing","open_mouth","clap","confetti_ball","hugs"],"has_accepted_answer":false,"can_create_shared_issue":false,"shared_issue_visible":false,"can_vote":false,"vote_count":0,"user_voted":false,"details":{"can_edit":false,"notification_level":1,"participants":[{"id":35937,"username":"james.warren","avatar_template":"/user_avatar/discuss.hashicorp.com/james.warren/{size}/44042_2.png","post_count":1,"primary_group_name":null,"flair_name":null,"flair_url":null,"flair_color":null,"flair_bg_color":null,"flair_group_id":null,"moderator":true,"trust_level":4}],"created_by":{"id":35937,"username":"james.warren","avatar_template":"/user_avatar/discuss.hashicorp.com/james.warren/{size}/44042_2.png"},"last_poster":{"id":35937,"username":"james.warren","avatar_template":"/user_avatar/discuss.hashicorp.com/james.warren/{size}/44042_2.png"}},"bookmarks":[]}