Bulletin ID: HCSEC-2026-59
Affected Products / Versions: Vault and Vault Enterprise 1.10.0 up to 2.2.1; fixed in Vault 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.26.
Publication Date: November 13, 2026
Summary
Vault’s Login MFA feature did not consistently enforce the lifetime of pending two-phase login requests. This may allow a user who previously completed the first authentication factor to complete MFA and obtain a Vault token after the pending request should have expired, including after the user’s primary credential has been rotated. This vulnerability (CVE-2026-92738) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.26.
Background
Vault’s Login MFA feature supports a two-phase login, in which a client first authenticates to an auth method and then completes a second factor, such as a TOTP passcode or a Duo, Okta, or PingID push, in a separate request. Between the two phases, Vault holds the result of the first-factor authentication in memory as a pending login request. Pending login requests are intended to remain valid for five minutes, after which the first factor must be repeated.
Details
Vault relied on a periodic background process to remove expired pending login requests, and did not check whether a pending request had expired when it was completed. Because this process removed expired requests at a limited rate, a backlog of older pending requests could delay removal of a later expired request, allowing it to be completed after its intended lifetime. An attacker who had completed the first factor, retained the resulting pending login request, and could still satisfy the configured second factor may have been able to obtain a new Vault token after the user’s primary credential had been rotated. The length of this extension depends on the size of the backlog, which an authenticated user could increase through repeated first-factor logins. This issue does not bypass the second factor. Single-phase Login MFA, in which MFA credentials are supplied with the original login request, is not affected, and pending login requests do not persist across a Vault restart or seal.
Remediation
Customers should evaluate the risk associated with this issue and consider upgrading to Vault Community Edition 2.2.2 or Vault Enterprise 2.2.2, 1.21.14, or 1.19.26. These versions also limit the number of pending Login MFA requests per entity, per client IP address, and in total, so operators whose clients reach Vault through a load balancer or proxy should ensure client addresses are forwarded correctly to avoid users sharing a single limit.
Acknowledgement
This issue was identified by an external party who reported it to HashiCorp.
We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see https://hashicorp.com/security.