Skip to contentHashicorp vulnerabilities
Newest
- hashicorp boundary, boundary enterprise +1 moreBoundary Workers Vulnerable to Denial of Service During TLS HandshakeCVE-2026-7776Fix available7.5 High
- hashicorp vault, vault enterprise, red hat openshift container platform 4 +1 more +3 moreVault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey OperationsCVE-2026-5807Fix available7.5 High
- hashicorp vault, vault enterprise, red hat openshift container platform 4 +1 more +3 moreVault Token Leaked to Backends via Authorization: Bearer Passthrough HeaderCVE-2026-4525Fix available7.5 High
- hashicorp vault, vault enterprise +1 moreVault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNSCVE-2026-5052Fix available5.3 Medium
- hashicorp vault, vault enterprise, red hat openshift container platform 4 +1 more +3 moreVault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-ServiceCVE-2026-3605Fix available8.1 High
- hashicorp tooling, red hat openshift container platform 4, trusted artifact signer +1 more +3 moreGo-getter may allow to arbitrary filesystem reads through git operationsCVE-2026-4660Public exploitFix available7.5 High
- hashicorp consul, consul enterprise +1 moreConsul vulnerable to arbitrary file reads through the vault kubernetes authentication providerCVE-2026-2808Fix available6.8 Medium
- hashicorp shared libraryArbitrary code execution in React server-side rendering of untrusted MDX contentCVE-2026-0969Fix available8.8 High
- hashicorp terraform provider, tooling +1 moreVault Terraform Provider Applied Incorrect Defaults for LDAP Auth MethodCVE-2025-13357Fix available7.4 High
- hashicorp terraform, terraform enterprise +1 moreTerraform Enterprise state versions can be created by users with specific permissions without sufficient write accessCVE-2025-134324.3 Medium
- hashicorp consul, consul enterprise +1 moreConsul's KV endpoint is vulnerable to denial of serviceCVE-2025-11374Fix available6.5 Medium
- hashicorp consul, consul enterprise +1 moreConsul's event endpoint is vulnerable to denial of serviceCVE-2025-11375Fix available6.5 Medium
- hashicorp vault, vault enterprise +1 moreVault Vulnerable to Denial of Service Due to Rate Limit RegressionCVE-2025-12044Fix available7.5 High
- hashicorp vault, vault enterprise +1 moreVault AWS auth method bypass due to AWS client cacheCVE-2025-11621Fix available8.1 High
- hashicorp vault, vault enterprise +1 moreVault unauthenticated denial of service through complex json payloadCVE-2025-6203Fix available7.5 High
- hashicorp go-getter, shared library +1 moreHashiCorp go-getter Vulnerable to Arbitrary Read through Symlink AttackCVE-2025-8959Fix available7.5 High
- hashicorp vault, vault enterprise +1 moreVault LDAP MFA Enforcement Bypass When Using Username As AliasCVE-2025-6013Fix available6.5 Medium
- hashicorp vault, vault enterprise +1 moreVault Login MFA Bypass of Rate Limiting and TOTP Code ReuseCVE-2025-6015Fix available5.7 Medium
- hashicorp vault, vault enterprise +1 moreTiming Side-Channel in Vault’s Userpass Auth MethodCVE-2025-6011Fix available3.7 Low
- hashicorp vault, vault enterprise +1 moreVault Userpass and LDAP User Lockout BypassCVE-2025-6004Fix available5.3 Medium
- hashicorp vault, vault enterprise +1 moreVault Certificate Auth Method Did Not Validate Common Name For Non-CA CertificatesCVE-2025-6037Fix available6.8 Medium
- hashicorp vault, vault enterprise +1 moreVault TOTP Secrets Engine Code ReuseCVE-2025-6014Fix available6.5 Medium
- hashicorp vault, vault enterprise +1 moreArbitrary Remote Code Execution via Plugin Catalog AbuseCVE-2025-6000Fix available9.1 Critical
- hashicorp vault, vault enterprise +1 moreVault Root Namespace Operator May Elevate Token PrivilegesCVE-2025-5999Fix available7.2 High
- hashicorp vault, vault enterprise +1 moreVault Vulnerable to Recovery Key Cancellation Denial of ServiceCVE-2025-4656Fix available3.1 Low
- hashicorp nomad, nomad enterprise +1 moreNomad Vulnerable To Incorrect ACL Policy Lookup Attached To A JobCVE-2025-4922Fix available8.1 High
- hashicorp nomad, nomad enterprise +1 moreNomad Vulnerable To Violation Of Mandatory Sentinel Policies in Nomad Job Submissions via Policy OverrideCVE-2025-37447.6 High
- hashicorp vault, vault enterprise +1 moreVault’s Azure Authentication Method bound_location Restriction Could be Bypassed on LoginCVE-2025-3879Fix available6.6 Medium
- hashicorp vault, vault enterprise, openbao +2 moreVault May Include Sensitive Data in Error Logs When Using the KV v2 PluginCVE-2025-4166Fix available4.5 Medium
- hashicorp nomad, nomad enterprise +1 moreNomad Exposes Sensitive Workload Identity and Client Secret Token in Audit LogsCVE-2025-1296Fix available6.5 Medium
- hashicorp hermes, tooling +1 moreHashiCorp Hermes Improperly Validates AWS ALB JWTs, which May Lead to Authentication BypassCVE-2025-1293Fix available8.2 High
- hashicorp nomad, nomad enterprise +1 moreNomad Vulnerable To Event Stream Namespace ACL Policy Bypass Through Wildcard NamespaceCVE-2025-09377.1 High
- hashicorp go-slug, shared library +1 moreHashiCorp go-slug Vulnerable to Zip Slip AttackCVE-2025-0377Fix available7.5 High
- hashicorp nomad, nomad enterprise +1 moreNomad Allocations Vulnerable To Privilege Escalation Within A Namespace Using Unredacted Workload Identity TokensCVE-2024-12678Fix available6.5 Medium
- hashicorp boundary, boundary enterprise +1 moreBoundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of ServiceCVE-2024-12289Fix available5.9 Medium
- hashicorp nomad, nomad enterprise +1 moreNomad Vulnerable To Cross-Namespace Volume Creation Abusing CSI Write PermissionCVE-2024-10975Fix available7.7 High
- hashicorp vault, vault enterprise, openbao +2 moreVault Vulnerable to Denial of Service When Processing Raft Join RequestsCVE-2024-8185Fix available7.5 High
- hashicorp consul, consul enterprise +1 moreConsul Vulnerable To Reflected XSS On Content-Type Error ManipulationCVE-2024-10086Fix available6.1 Medium
- hashicorp consul, consul enterprise +1 moreConsul L7 Intentions Vulnerable To Headers BypassCVE-2024-10006Fix available8.3 High
- hashicorp consul, consul enterprise +1 moreConsul L7 Intentions Vulnerable To URL Path BypassCVE-2024-10005Public exploitFix available8.1 High
- hashicorp vagrant, vagrant vmware utility +1 moreVagrant VMWare Utility installation files vulnerable to modification by unprivileged userCVE-2024-102283.8 Low
- hashicorp vault, vault enterprise, openbao +2 moreVault Operators in Root Namespace May Elevate Their PrivilegesCVE-2024-9180Fix available7.2 High
- hashicorp vault, vault enterprise, vault community edition +1 more +3 moreVault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By DefaultCVE-2024-7594Fix available7.5 High
- hashicorp vault, vault enterprise +1 moreVault Leaks AppRole Client Tokens And Accessor in Audit LogCVE-2024-8365Fix available6.2 Medium
- hashicorp nomad, nomad enterprise +1 moreNomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive UnpackingCVE-2024-7625Fix available5.8 Medium
- hashicorp nomad, nomad enterprise +1 moreNomad Vulnerable to Allocation Directory Path Escape Through Archive UnpackingCVE-2024-6717Fix available7.7 High
- hashicorp vault, vault enterprise +1 moreVault Vulnerable to Denial of Service When Setting a Proxy Protocol BehaviorCVE-2024-6468Fix available7.5 High
- hashicorp go-getter, shared library +1 moreHashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config ManipulationCVE-2024-6257Fix available8.4 High
- hashicorp retryablehttp, shared library +1 morego-retryablehttp can leak basic auth credentials to log filesCVE-2024-6104Fix available6.0 Medium
- hashicorp vault, vault enterprise +1 moreVault Incorrectly Validated JSON Web Tokens (JWT) Audience ClaimsCVE-2024-5798Fix available2.6 Low
- Show moreLoading…