HashiCorp Vault security vulnerabilities
Open-source infrastructure. Public CVE monitoring for HashiCorp Vault. Vendor security advisories are linked on this page.
Built for Operators of this product.
16 public records · 0 security-fix timeline events. 0 published in the last 7 days. 12 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 0
- High 0
- Medium 0
- Low 0
2026-08-100 issues2026-11-07
Known exploited
View all known exploitedNo records match this view.
Recently published
Browse catalog- High8.6Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges.Check if you run itEPSS 0.34%Apr 17, 2026
- High7.5HCSEC-2026-08 - Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey OperationsCheck if you run itEPSS 0.72%Apr 17, 2026
- Medium4.3Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permissionCheck if you run itEPSS 0.23%Dec 10, 2025
- High7.5Vault and Vault Enterprise (“Vault”) are vulnerable to an unauthenticated denial of service when processing JSON payloads.Check if you run itEPSS 0.53%Oct 23, 2025
- High8.1Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS accountsCheck if you run itEPSS 0.49%Oct 23, 2025
- Medium6.5Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs that are equal but withCheck if you run itEPSS 0.57%Aug 6, 2025
- Medium5.7Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused.Check if you run itEPSS 0.38%Aug 1, 2025
- Medium5.3Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods.Check if you run itEPSS 0.46%Aug 1, 2025
- Medium6.5Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period.Check if you run itEPSS 0.45%Aug 1, 2025
- Critical9.1A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’Check if you run itEPSS 0.96%Aug 1, 2025