# HCSEC-2026-57 - Vault audit device prefix vulnerable to log injection

**URL:** <https://discuss.hashicorp.com/t/hcsec-2026-57-vault-audit-device-prefix-vulnerable-to-log-injection/78200>\
**Category:** Security\
**Tags:** security-vault\
**Created:** [November 12, 2026, 10:30pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-57-vault-audit-device-prefix-vulnerable-to-log-injection/78200 "2026-11-12T22:30:40Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![james.warren](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/james.warren/32/44042_2.png) [@james.warren](https://discuss.hashicorp.com/u/james.warren)\
**Post date:** [November 12, 2026, 10:30pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-57-vault-audit-device-prefix-vulnerable-to-log-injection/78200/1 "2026-11-12T22:30:40Z")

</div>

**Bulletin ID:** HCSEC-2026-57

**Affected Products / Versions:** Vault and Vault Enterprise up to 2.2.1; fixed in Vault 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.

**Publication Date:** November 12, 2026

**Summary**

Vault’s audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading audit records. This vulnerability (CVE-2026-93333) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.

**Background**

Vault audit devices record requests and responses for operational and security review, and support an optional prefix that is prepended to each audit log entry. Because audit logs are relied upon as a trusted record of activity, Vault provides the `allow_audit_log_prefixing` server configuration parameter, which is disabled by default and is intended to prevent audit devices from using prefixes unless an administrator explicitly allows it.

**Details**

Vault did not reject control characters or line separator characters in an audit log prefix. Because the prefix is written ahead of every audit entry, a crafted prefix could cause log consumers to interpret a single audit entry as multiple records, potentially allowing fabricated entries to appear alongside legitimate ones. In addition, the `allow_audit_log_prefixing` parameter was only enforced for file audit devices, so socket and syslog audit devices could be configured with a prefix even when the parameter was disabled. This issue requires an authenticated operator with privileges to enable audit devices. File audit devices are only affected when `allow_audit_log_prefixing` is enabled.

**Remediation**

Customers should evaluate the risk associated with this issue and consider upgrading to Vault Community Edition 2.2.2 or Vault Enterprise 2.2.2, 1.21.14, or 1.19.25. After upgrading, existing audit devices configured with a prefix will continue to operate without the prefix if `allow_audit_log_prefixing` is disabled or if the prefix contains disallowed characters.

**Acknowledgement**

This issue was reported to HashiCorp by Tal Vaknin, Independent Security Researcher.

_We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see [https://hashicorp.com/security](https://hashicorp.com/security)._