Hashicorp vulnerabilities

Products

• Vault 78
• Consul 52
• Vault Enterprise 49
• Nomad 44
• Consul Enterprise 27
• Nomad Enterprise 26
• Tooling 13
• Shared Library 10
• Go-getter 9
• Boundary 7
• Vagrant Vmware Fusion 7
• Terraform 5
• Terraform Enterprise 5
• Vagrant 5
• Boundary Enterprise 4
• Vault Enterprise 4
• Go-slug 3
• Terraform Enterprise 3
• Packer 2
• Sentinel 2
• Terraform Provider 2

Newest

• hashicorp boundary, boundary enterprise +1 more Boundary vulnerable to server-side request forgery in Vault credential store CVE-2026-13303 8.7 HighOctober 29, 2026
• hashicorp nomad, nomad enterprise +1 more Nomad allocation data migration may allow host directory permission modification via symlink following CVE-2026-119168 8.8 HighOctober 29, 2026
• hashicorp nomad, nomad enterprise +1 more Nomad dispatch payload writes can escape the allocation directory through symlinks CVE-2026-107347 8.4 HighOctober 29, 2026
• hashicorp nomad, nomad enterprise +1 more Nomad vulnerable to cross-namespace information disclosure in multiple endpoints CVE-2026-102260 4.3 MediumOctober 29, 2026
• hashicorp tooling Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules CVE-2026-110720 Public exploit 9.9 CriticalOctober 26, 2026
• hashicorp consul, consul enterprise +1 more Consul vulnerable to an authorization bypass in health check registration CVE-2026-115804 6.4 MediumOctober 26, 2026
• hashicorp consul, consul enterprise +1 more Consul vulnerable to a denial of service in HTTP APIs CVE-2026-105626 7.5 HighOctober 26, 2026
• hashicorp consul, consul enterprise +1 more Consul vulnerable to an authorization bypass in service mesh registration CVE-2026-105608 8.8 HighOctober 26, 2026
• hashicorp consul, consul enterprise +1 more Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API CVE-2026-105765 7.5 HighOctober 26, 2026
• hashicorp shared library Go-getter vulnerable to a path traversal in S3/GCS directory download handling CVE-2026-19585 Fix available 5.3 MediumOctober 8, 2026
• hashicorp vault, vault enterprise +1 more Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions CVE-2026-89322 Fix available 7.2 HighOctober 7, 2026
• hashicorp vault enterprise Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution CVE-2026-105820 Fix available 5.4 MediumOctober 7, 2026
• hashicorp vault, vault enterprise +1 more Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots CVE-2026-105816 Fix available 8.0 HighOctober 7, 2026
• hashicorp vault, vault enterprise +1 more Vault PKI ACME Issues Certificate With Unvalidated SANs CVE-2026-105818 Fix available 5.9 MediumOctober 7, 2026
• hashicorp shared library Go-getter vulnerable to a privilege escalation issue in its archive decompression handling CVE-2026-88922 Fix available 6.7 MediumSeptember 15, 2026
• hashicorp tooling Consul-template vulnerable to an information disclosure issue in error handling CVE-2026-87993 Fix available 7.7 HighSeptember 10, 2026
• hashicorp consul, consul enterprise +1 more Consul vulnerable to an authorization bypass in the Connect service mesh CVE-2026-88021 Fix available 7.5 HighSeptember 10, 2026
• hashicorp consul, consul enterprise +1 more Consul vulnerable to an authorization bypass in the catalog deregistration path CVE-2026-87107 Fix available 5.4 MediumSeptember 10, 2026
• hashicorp consul, consul enterprise +1 more Consul vulnerable to a denial of service in the native RPC listener CVE-2026-87106 Fix available 6.5 MediumSeptember 10, 2026
• hashicorp consul, consul enterprise +1 more Consul vulnerable to an authorization bypass in the catalog node-write path CVE-2026-87090 Fix available 8.3 HighSeptember 10, 2026
• hashicorp vault, vault enterprise +1 more Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths CVE-2026-5006 Public exploitFix available 6.8 MediumAugust 24, 2026
• hashicorp go-slug Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions CVE-2026-14978 5.5 MediumAugust 19, 2026
• hashicorp packer Packer vulnerable to arbitrary file write via crafted plugin archive during installation CVE-2026-19589 Fix available 7.1 HighAugust 17, 2026
• hashicorp tooling Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath CVE-2026-8715 Fix available 9.6 CriticalAugust 13, 2026
• hashicorp vault enterprise Vault Enterprise vulnerable to cross-namespace entity deletion CVE-2026-14886 Fix available 8.2 HighAugust 10, 2026
• hashicorp vault, vault enterprise +1 more Vault vulnerable to LIST authorization bypass via trailing-slash strip CVE-2026-12624 Fix available 4.3 MediumAugust 10, 2026
• hashicorp consul, consul enterprise +1 more Unauthenticated denial of service via unbounded request body processing CVE-2026-19113 Fix available 5.3 MediumAugust 7, 2026
• hashicorp consul, consul enterprise +1 more Unauthenticated denial of service via unbounded external gRPC connection acceptance CVE-2026-15972 Fix available 7.5 HighAugust 7, 2026
• hashicorp consul, consul enterprise +1 more L7 intention authorization bypass via custom public listener CVE-2026-15970 Fix available 4.2 MediumAugust 7, 2026
• hashicorp consul, consul enterprise +1 more Consul vulnerable to partial arbitrary file read via Vault Connect CA provider CVE-2026-19017 Fix available 6.8 MediumAugust 7, 2026
• hashicorp consul, consul enterprise +1 more Uncontrolled resource consumption in the Consul Connect CA roots endpoint CVE-2026-19015 Fix available 5.3 MediumAugust 7, 2026
• hashicorp consul, consul enterprise +1 more Uncontrolled resource consumption in the Consul Connect authorization endpoint CVE-2026-19014 Fix available 4.3 MediumAugust 7, 2026
• hashicorp consul, consul enterprise +1 more Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade path CVE-2026-19012 Fix available 5.3 MediumAugust 7, 2026
• hashicorp consul, consul enterprise +1 more Authorization bypass for session deletion in the transaction API CVE-2026-19016 Fix available 4.2 MediumAugust 7, 2026
• hashicorp tooling consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode CVE-2026-16326 Fix available 10.0 CriticalJuly 29, 2026
• hashicorp tooling consul-mcp-server vulnerable to server side request forgery leading to token exposure CVE-2026-16328 Fix available 8.6 HighJuly 29, 2026
• hashicorp tooling terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode CVE-2026-16498 Fix available 10.0 CriticalJuly 28, 2026
• hashicorp tooling terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user CVE-2026-16496 Fix available 8.9 HighJuly 28, 2026
• hashicorp tooling terraform-mcp-server vulnerable to server side request forgery leading to token exposure CVE-2026-14869 Fix available 8.6 HighJuly 28, 2026
• hashicorp nomad, nomad enterprise +1 more Nomad vulnerable to cross-namespace host volume claim deletion CVE-2026-14896 4.2 MediumJuly 8, 2026
• hashicorp tooling Consul-template is vulnerable to path redirection in writeToFile through symlink attack CVE-2026-14361 Public exploit 4.7 MediumJuly 8, 2026
• hashicorp nomad, nomad enterprise +1 more Nomad vulnerable to sandbox escape in Docker task driver CVE-2026-14891 8.7 HighJuly 8, 2026
• hashicorp nomad, nomad enterprise +1 more Nomad Docker driver Linux host namespace bypass CVE-2026-14373 7.7 HighJuly 8, 2026
• hashicorp shared library Denial of service via crafted push/pull gossip message in memberlist CVE-2026-14362 4.9 MediumJuly 8, 2026
• hashicorp terraform enterprise Path traversal allows arbitrary file read in Terraform Enterprise container CVE-2026-14468 7.7 HighJuly 6, 2026
• hashicorp vault, vault enterprise +1 more Audit Log Plugin Directory Guard Bypass via Legacy path Option CVE-2026-5051 Fix available 4.4 MediumJuly 1, 2026
• hashicorp nomad, nomad enterprise +1 more Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution CVE-2026-7474 Fix available 8.8 HighMay 12, 2026
• hashicorp shared library Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attack CVE-2026-8052 Fix available 6.0 MediumMay 12, 2026
• hashicorp nomad, nomad enterprise +1 more Nomad vulnerable to arbitrary file read/write on client host through symlink attack CVE-2026-6959 Fix available 6.0 MediumMay 12, 2026
• hashicorp tooling Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack CVE-2026-5061 Public exploitFix available 4.7 MediumMay 12, 2026
• Show olderLoading…