Hashicorp Tooling vulnerabilities

• hashicorp tooling Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules CVE-2026-110720 Public exploit 9.9 CriticalOctober 26, 2026
• hashicorp tooling Consul-template vulnerable to an information disclosure issue in error handling CVE-2026-87993 Fix available 7.7 HighSeptember 10, 2026
• hashicorp tooling Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath CVE-2026-8715 Fix available 9.6 CriticalAugust 13, 2026
• hashicorp tooling consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode CVE-2026-16326 Fix available 10.0 CriticalJuly 29, 2026
• hashicorp tooling consul-mcp-server vulnerable to server side request forgery leading to token exposure CVE-2026-16328 Fix available 8.6 HighJuly 29, 2026
• hashicorp tooling terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode CVE-2026-16498 Fix available 10.0 CriticalJuly 28, 2026
• hashicorp tooling terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user CVE-2026-16496 Fix available 8.9 HighJuly 28, 2026
• hashicorp tooling terraform-mcp-server vulnerable to server side request forgery leading to token exposure CVE-2026-14869 Fix available 8.6 HighJuly 28, 2026
• hashicorp tooling Consul-template is vulnerable to path redirection in writeToFile through symlink attack CVE-2026-14361 Public exploit 4.7 MediumJuly 8, 2026
• hashicorp tooling Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack CVE-2026-5061 Public exploitFix available 4.7 MediumMay 12, 2026
• hashicorp tooling, red hat openshift container platform 4, trusted artifact signer +1 more +3 more Go-getter may allow to arbitrary filesystem reads through git operations CVE-2026-4660 Public exploitFix available 7.5 HighApril 9, 2026
• hashicorp terraform provider, tooling +1 more Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method CVE-2025-13357 Fix available 7.4 HighNovember 21, 2025
• hashicorp hermes, tooling +1 more HashiCorp Hermes Improperly Validates AWS ALB JWTs, which May Lead to Authentication Bypass CVE-2025-1293 Fix available 8.2 HighFebruary 20, 2025