{"id":"CVE-2026-13303","aliases":["EUVD-2026-113390","GHSA-ff4v-fpcj-mjf6"],"status":"published","title":"Boundary vulnerable to server-side request forgery in Vault credential store","description":"HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue outbound requests to a network destination of the requester's choosing and to receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service. This vulnerability, CVE-2026-13303, is fixed in Boundary Enterprise 1.0.2 and 0.21.6.","severity":{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00222,"percentile":0.12938,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-918"],"published":"2026-10-29T21:03:41Z","modified":"2026-10-30T19:37:07Z","products":[{"vendor":"hashicorp","product":"boundary"},{"vendor":"hashicorp","product":"boundary enterprise"}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-54-boundary-vulnerable-to-server-side-request-forgery-in-vault-credential-store/77932"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13303"},{"url":"https://github.com/advisories/GHSA-ff4v-fpcj-mjf6"}],"sources":{"cve":[{"id":"CVE-2026-13303","title":"Boundary vulnerable to server-side request forgery in Vault credential store","description":"HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue outbound requests to a network destination of the requester's choosing and to receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service. This vulnerability, CVE-2026-13303, is fixed in Boundary Enterprise 1.0.2 and 0.21.6.","status":"published","published":"2026-10-29T21:03:41.322Z","modified":"2026-10-30T17:08:58.961Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:19:49.885652Z"}],"euvd":[{"id":"EUVD-2026-113390","description":"HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue outbound requests to a network destination of the requester's choosing and to receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service. This vulnerability, CVE-2026-13303, is fixed in Boundary Enterprise 1.0.2 and 0.21.6.","status":"published","published":"2026-10-29T21:03:41Z","modified":"2026-10-30T17:08:58Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:59:05.567782Z"}],"ghsa":[{"id":"GHSA-ff4v-fpcj-mjf6","title":"HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the...","description":"HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue outbound requests to a network destination of the requester's choosing and to receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service. This vulnerability, CVE-2026-13303, is fixed in Boundary Enterprise 1.0.2 and 0.21.6.","status":"published","published":"2026-10-29T21:31:31Z","modified":"2026-10-29T21:31:37Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:14:41.240878Z"}],"nvd":[{"id":"CVE-2026-13303","description":"HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue outbound requests to a network destination of the requester's choosing and to receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service. This vulnerability, CVE-2026-13303, is fixed in Boundary Enterprise 1.0.2 and 0.21.6.","status":"published","published":"2026-10-29T21:17:22Z","modified":"2026-10-30T19:37:07.073Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:13:04.940026Z"}]}}