|
HCSEC-2026-43 - Vault Inconsistent ACL Policy Evaluation May Allow Bypass of Deny Restrictions
|
|
0
|
288
|
October 7, 2026
|
|
HCSEC-2026-42 - Vault Enterprise ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution
|
|
0
|
229
|
October 7, 2026
|
|
HCSEC-2026-41 - Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots
|
|
0
|
472
|
October 7, 2026
|
|
HCSEC-2026-40 - Vault PKI ACME Default Directory Policy May Issue Certificates With Unverified Identities
|
|
0
|
267
|
October 7, 2026
|
|
HCSEC-2026-32 - Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths
|
|
0
|
629
|
August 24, 2026
|
|
HCSEC-2026-28 - Vault Secrets Operator vulnerable to arbitrary file read via AppRole secretIDPath
|
|
0
|
818
|
August 13, 2026
|
|
HCSEC-2026-27 - Vault Enterprise vulnerable to cross-namespace entity deletion
|
|
0
|
555
|
August 10, 2026
|
|
HCSEC-2026-26 - Vault vulnerable to LIST authorization bypass via trailing-slash strip
|
|
0
|
386
|
August 10, 2026
|
|
HCSEC-2026-16 - Vault Audit Device Plugin Directory Guard Bypass via Legacy Path Option
|
|
0
|
424
|
July 1, 2026
|
|
HCSEC-2026-08 - Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations
|
|
0
|
1141
|
April 17, 2026
|
|
HCSEC-2026-07 - Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization
|
|
0
|
833
|
April 17, 2026
|
|
HCSEC-2026-06 - Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS
|
|
0
|
809
|
April 17, 2026
|
|
HCSEC-2026-05 - Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service
|
|
0
|
1075
|
April 17, 2026
|
|
HCSEC-2025-21 - Vault User Enumeration in Userpass Auth Method
|
|
1
|
1930
|
February 13, 2026
|
|
HCSEC-2025-33 - Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method
|
|
0
|
1517
|
November 21, 2025
|
|
HCSEC-2025-32 - Incomplete Fix For Previous Vault DoS Issue
|
|
0
|
570
|
October 23, 2025
|
|
HCSEC-2025-31- Vault Vulnerable to Denial of Service Due to Rate Limit Regression
|
|
0
|
2064
|
October 23, 2025
|
|
HCSEC-2025-30 - Vault AWS Auth Method Authentication Bypass Through Mishandling of Cache Entries
|
|
0
|
1792
|
October 23, 2025
|
|
HCSEC-2025-24 - Vault Denial of Service Though Complex JSON Payloads
|
|
0
|
2878
|
August 28, 2025
|
|
HCSEC-2025-13 - Vault Root Namespace Operator May Elevate Token Privileges
|
|
0
|
2505
|
August 1, 2025
|
|
HCSEC-2025-22 - Multiple Vulnerabilities Impacting HashiCorp Vault and Vault Enterprise
|
|
0
|
6098
|
August 6, 2025
|
|
HCSEC-2025-20 - Vault LDAP MFA Enforcement Bypass When Using Username As Alias
|
|
0
|
2118
|
August 6, 2025
|
|
HCSEC-2025-17 - Vault TOTP Secrets Engine Code Reuse
|
|
0
|
1561
|
August 1, 2025
|
|
HCSEC-2025-19 - Vault Login MFA Bypass of Rate Limiting and TOTP Token Reuse
|
|
0
|
1537
|
August 1, 2025
|
|
HCSEC-2025-18 - Vault Certificate Auth Method Did Not Validate Common Name For Non-CA Certificates
|
|
0
|
1525
|
August 1, 2025
|
|
HCSEC-2025-16 - Vault Userpass and LDAP User Lockout Bypass
|
|
0
|
1796
|
August 1, 2025
|
|
HCSEC-2025-15 - Timing Side-Channel in Vault’s Userpass Auth Method
|
|
0
|
1552
|
August 1, 2025
|
|
HCSEC-2025-14 - Privileged Vault Operator May Execute Code on the Underlying Host
|
|
0
|
5731
|
August 1, 2025
|
|
HCSEC-2025-11 Vault Vulnerable to Recovery Key Cancellation Denial of Service
|
|
0
|
1370
|
June 25, 2025
|
|
HCSEC-2025-09 - Vault May Expose Sensitive Information in Error Logs When Processing Malformed Data With the KV v2 Plugin
|
|
0
|
2476
|
May 2, 2025
|