{"id":"CVE-2026-93333","aliases":["EUVD-2026-124747","GHSA-w4qh-g6vc-38wx"],"status":"published","title":"Vault audit device prefix vulnerable to log injection","description":"Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading audit records. This vulnerability (CVE-2026-93333) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.","severity":{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-117"],"published":"2026-11-12T22:32:43.853Z","modified":"2026-11-13T00:32:04Z","products":[{"vendor":"hashicorp","product":"vault"},{"vendor":"hashicorp","product":"vault enterprise"}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-57-vault-audit-device-prefix-vulnerable-to-log-injection/78200"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93333"},{"url":"https://github.com/advisories/GHSA-w4qh-g6vc-38wx"}],"sources":{"cve":[{"id":"CVE-2026-93333","title":"Vault audit device prefix vulnerable to log injection","description":"Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading audit records. This vulnerability (CVE-2026-93333) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.","status":"published","published":"2026-11-12T22:32:43.853Z","modified":"2026-11-12T22:32:43.853Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-117"],"updated_at":"2026-11-12T23:50:00.740852Z"}],"euvd":[{"id":"EUVD-2026-124747","description":"Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading audit records. This vulnerability (CVE-2026-93333) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.","status":"published","published":"2026-11-13T00:31:58Z","modified":"2026-11-13T00:31:58Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-13T01:36:41.572072Z"}],"ghsa":[{"id":"GHSA-w4qh-g6vc-38wx","title":"Vault's audit devices did not validate the contents of a configured audit log prefix and did not...","description":"Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading audit records. This vulnerability (CVE-2026-93333) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.","status":"published","published":"2026-11-13T00:31:58Z","modified":"2026-11-13T00:32:04Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-117"],"updated_at":"2026-11-13T00:44:37.510355Z"}],"nvd":[{"id":"CVE-2026-93333","description":"Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading audit records. This vulnerability (CVE-2026-93333) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.","status":"published","published":"2026-11-13T00:20:18.883Z","modified":"2026-11-13T00:20:18.883Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-117"],"updated_at":"2026-11-13T01:33:42.076678Z"}]}}