Bulletin ID: HCSEC-2026-57
Affected Products / Versions: Vault and Vault Enterprise up to 2.2.1; fixed in Vault 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.
Publication Date: November 12, 2026
Summary
Vault’s audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading audit records. This vulnerability (CVE-2026-93333) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.
Background
Vault audit devices record requests and responses for operational and security review, and support an optional prefix that is prepended to each audit log entry. Because audit logs are relied upon as a trusted record of activity, Vault provides the allow_audit_log_prefixing server configuration parameter, which is disabled by default and is intended to prevent audit devices from using prefixes unless an administrator explicitly allows it.
Details
Vault did not reject control characters or line separator characters in an audit log prefix. Because the prefix is written ahead of every audit entry, a crafted prefix could cause log consumers to interpret a single audit entry as multiple records, potentially allowing fabricated entries to appear alongside legitimate ones. In addition, the allow_audit_log_prefixing parameter was only enforced for file audit devices, so socket and syslog audit devices could be configured with a prefix even when the parameter was disabled. This issue requires an authenticated operator with privileges to enable audit devices. File audit devices are only affected when allow_audit_log_prefixing is enabled.
Remediation
Customers should evaluate the risk associated with this issue and consider upgrading to Vault Community Edition 2.2.2 or Vault Enterprise 2.2.2, 1.21.14, or 1.19.25. After upgrading, existing audit devices configured with a prefix will continue to operate without the prefix if allow_audit_log_prefixing is disabled or if the prefix contains disallowed characters.
Acknowledgement
This issue was reported to HashiCorp by Tal Vaknin, Independent Security Researcher.
We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see https://hashicorp.com/security.