HashiCorp

Latest CVEs · RSS

• CVE-2026-19585 2026-10-08 · CVSS 5.3
  HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which
• CVE-2026-89322 2026-10-07 · CVSS 7.2
  Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated u
• CVE-2026-105820 2026-10-07 · CVSS 5.4
  Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted po
• CVE-2026-105816 2026-10-07 · CVSS 8.0
  Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault
• CVE-2026-105818 2026-10-07 · CVSS 5.9
  Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default
• CVE-2026-88922 2026-09-15 · CVSS 6.7
  The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafte
• CVE-2026-87993 2026-09-10 · CVSS 7.7
  The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template
• CVE-2026-88021 2026-09-10 · CVSS 7.5
  Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not aut
• CVE-2026-87107 2026-09-10 · CVSS 5.4
  Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-import
• CVE-2026-87106 2026-09-10 · CVSS 6.5
  Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory be
• CVE-2026-87090 2026-09-10 · CVSS 8.3
  Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another
• CVE-2026-5006 2026-08-24 · CVSS 6.8
  A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may manipulate an identity value referenced
• CVE-2026-19589 2026-08-17 · CVSS 7.1
  Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code exec
• CVE-2026-8715 2026-08-13 · CVSS 9.6
  Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration t
• CVE-2026-14886 2026-08-10 · CVSS 8.2
  Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one n
• CVE-2026-12624 2026-08-10 · CVSS 4.3
  Vault’s ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a trailing slash on the denied path. This may
• CVE-2026-19113 2026-08-07 · CVSS 5.3
  Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A
• CVE-2026-15972 2026-08-07 · CVSS 7.5
  Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptan
• CVE-2026-15970 2026-08-07 · CVSS 4.2
  Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured wi
• CVE-2026-19017 2026-08-07 · CVSS 6.8
  Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA
• CVE-2026-19015 2026-08-07 · CVSS 5.3
  Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint
• CVE-2026-19014 2026-08-07 · CVSS 4.3
  Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization en
• CVE-2026-19012 2026-08-07 · CVSS 5.3
  Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition
• CVE-2026-19016 2026-08-07 · CVSS 4.2
  Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the ACL permission for session deletion operations submitt
• CVE-2026-16326 2026-07-29 · CVSS 10.0
  In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication to