CVEs.

Matching CVEs

1. 8.7High

   CVE-2026-13303 ↗ (opens in a new tab)

   HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue outbound requests to a network destination of the requester's choosing and to receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service. This vulnerability, CVE-2026-13303, is fixed in Boundary Enterprise 1.0.2 and 0.21.6.

   HAHashiCorp (HCP / Terraform Cloud)· Oct 29, 2026

2. 8.8High

   CVE-2026-119168 ↗ (opens in a new tab)

   HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

   HAHashiCorp (HCP / Terraform Cloud)· Oct 29, 2026

3. 8.4High

   CVE-2026-107347 ↗ (opens in a new tab)

   HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory. When the client agent runs as root, this could lead to code execution as root on the client host. This vulnerability (CVE-2026-107347) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

   HAHashiCorp (HCP / Terraform Cloud)· Oct 29, 2026

4. 4.3Med

   CVE-2026-102260 ↗ (opens in a new tab)

   HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read permissions in one namespace to view information about objects in other namespaces. This vulnerability (CVE-2026-102260) is fixed in Nomad Community Edition 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

   HAHashiCorp (HCP / Terraform Cloud)· Oct 29, 2026

5. 9.9Crit

   CVE-2026-110720 ↗ (opens in a new tab)

   Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18.

   HAHashiCorp (HCP / Terraform Cloud)· Oct 26, 2026

6. 6.4Med

   CVE-2026-115804 ↗ (opens in a new tab)

   HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability (CVE-2026-115804) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

   HAHashiCorp (HCP / Terraform Cloud)· Oct 26, 2026

7. 7.5High

   CVE-2026-105765 ↗ (opens in a new tab)

   HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

   HAHashiCorp (HCP / Terraform Cloud)· Oct 26, 2026

8. 7.5High

   CVE-2026-105626 ↗ (opens in a new tab)

   HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

   HAHashiCorp (HCP / Terraform Cloud)· Oct 26, 2026

9. 8.8High

   CVE-2026-105608 ↗ (opens in a new tab)

   HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission. This vulnerability (CVE-2026-105608) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

   HAHashiCorp (HCP / Terraform Cloud)· Oct 26, 2026

10. 5.3Med

    CVE-2026-19585 ↗ (opens in a new tab)

    HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability (CVE-2026-19585) is fixed in go-getter 1.8.10 and go-getter/v2 2.2.5.

    HAHashiCorp (HCP / Terraform Cloud)· Oct 8, 2026

11. 7.2High

    CVE-2026-89322 ↗ (opens in a new tab)

    Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy, potentially leading to privilege escalation. This vulnerability (CVE-2026-89322) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.

    HAHashiCorp (HCP / Terraform Cloud)· Oct 7, 2026

12. 5.4Med

    CVE-2026-105820 ↗ (opens in a new tab)

    Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability (CVE-2026-105820) is fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Vault Community Edition does not support namespaces, and is not affected.

    HAHashiCorp (HCP / Terraform Cloud)· Oct 7, 2026

13. 5.9Med

    CVE-2026-105818 ↗ (opens in a new tab)

    Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling impersonation toward systems that trust certificates issued by the affected Vault PKI mount. This vulnerability (CVE-2026-105818) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.

    HAHashiCorp (HCP / Terraform Cloud)· Oct 7, 2026

14. 8.0High

    CVE-2026-105816 ↗ (opens in a new tab)

    Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory configured, a privileged operator able to restore an Integrated Storage (Raft) snapshot may be able to execute arbitrary code on the Vault host. This vulnerability (CVE-2026-105816) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.

    HAHashiCorp (HCP / Terraform Cloud)· Oct 7, 2026

15. 6.7Med

    CVE-2026-88922 ↗ (opens in a new tab)

    The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.

    HAHashiCorp (HCP / Terraform Cloud)· Sep 15, 2026

16. 7.1High

    CVE-2026-88021 ↗ (opens in a new tab)

    Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not authorized to access. When building Envoy RBAC rules to enforce Connect intentions, Consul did not correctly escape certain characters in service names, namespaces, and partitions, causing the generated authorization rules to match more broadly than intended. This vulnerability (CVE-2026-88021) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.

    HAHashiCorp (HCP / Terraform Cloud)· Sep 10, 2026

17. 7.7High

    CVE-2026-87993 ↗ (opens in a new tab)

    The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability (CVE-2026-87993) is fixed in consul-template 0.43.0.

    HAHashiCorp (HCP / Terraform Cloud)· Sep 10, 2026

18. 5.4Med

    CVE-2026-87107 ↗ (opens in a new tab)

    Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-imported catalog objects. A caller with {{service:write}} or {{node:write}} permission may exploit this issue to remove services, checks, or nodes imported from a peered cluster without holding authority over the peer origin. This vulnerability (CVE-2026-87107) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.

    HAHashiCorp (HCP / Terraform Cloud)· Sep 10, 2026

19. 6.5Med

    CVE-2026-87106 ↗ (opens in a new tab)

    Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory before ACL authorization is evaluated. A client that can complete the internal RPC mTLS handshake may exploit this issue without holding a valid ACL token. This vulnerability (CVE-2026-87106) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.

    HAHashiCorp (HCP / Terraform Cloud)· Sep 10, 2026

20. 8.3High

    CVE-2026-87090 ↗ (opens in a new tab)

    Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node's catalog registration and take over its node identity. An attacker with a token granting node-write permission on any single node name may exploit this issue if they can obtain the node ID of a node they do not control. This vulnerability (CVE-2026-87090) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.

    HAHashiCorp (HCP / Terraform Cloud)· Sep 10, 2026

21. 6.8Med

    CVE-2026-5006 ↗ (opens in a new tab)

    A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include slash ({{/}}) characters that Vault interprets as additional path segments when rendering the policy. This vulnerability, CVE-2026-5006, was fixed in Vault Community Edition 2.0.4 and Vault Enterprise 2.0.4, 1.21.9, 1.20.14, and 1.19.20.

    HAHashiCorp (HCP / Terraform Cloud)· Aug 24, 2026

22. 5.5Med

    CVE-2026-14978 ↗ (opens in a new tab)

    HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.

    HAHashiCorp (HCP / Terraform Cloud)· Aug 19, 2026

23. 7.1High

    CVE-2026-19589 ↗ (opens in a new tab)

    Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability (CVE-2026-19589) is fixed in Packer 1.16.0.

    HAHashiCorp (HCP / Terraform Cloud)· Aug 17, 2026

24. 9.6Crit

    CVE-2026-8715 ↗ (opens in a new tab)

    Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit their contents to a tenant-controlled endpoint, potentially leading to privilege escalation within the cluster. This vulnerability (CVE-2026-8715) is fixed in Vault Secrets Operator 1.5.0.

    HAHashiCorp (HCP / Terraform Cloud)· Aug 13, 2026

25. 8.2High

    CVE-2026-14886 ↗ (opens in a new tab)

    Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability (CVE-2026-14886) is fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20.

    HAHashiCorp (HCP / Terraform Cloud)· Aug 10, 2026

26. 4.3Med

    CVE-2026-12624 ↗ (opens in a new tab)

    Vault’s ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was intended to be denied access to. This vulnerability (CVE-2026-12624) is fixed in Vault Community Edition 2.0.3 and Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19.

    HAHashiCorp (HCP / Terraform Cloud)· Aug 10, 2026

27. 5.3Med

    CVE-2026-19113 ↗ (opens in a new tab)

    Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

    HAHashiCorp (HCP / Terraform Cloud)· Aug 7, 2026

28. 6.8Med

    CVE-2026-19017 ↗ (opens in a new tab)

    Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with `operator:write` permission may direct Consul to read and forward credential files outside the intended scope, potentially leading to the exfiltration of sensitive secrets from the Consul server host. This vulnerability, CVE-2026-19017, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

    HAHashiCorp (HCP / Terraform Cloud)· Aug 7, 2026

29. 4.2Med

    CVE-2026-19016 ↗ (opens in a new tab)

    Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions without holding the required permission. This vulnerability, CVE-2026-19016, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

    HAHashiCorp (HCP / Terraform Cloud)· Aug 7, 2026

30. 5.3Med

    CVE-2026-19015 ↗ (opens in a new tab)

    Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-19015, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

    HAHashiCorp (HCP / Terraform Cloud)· Aug 7, 2026

31. 4.3Med

    CVE-2026-19014 ↗ (opens in a new tab)

    Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-190124, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

    HAHashiCorp (HCP / Terraform Cloud)· Aug 7, 2026

32. 5.3Med

    CVE-2026-19012 ↗ (opens in a new tab)

    Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition downgrade path that may allow an authorized caller to crash the Consul server. A caller with config-entry write permission can submit a service-router configuration entry that causes the agent to exit unexpectedly. This vulnerability, CVE-2026-19012, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

    HAHashiCorp (HCP / Terraform Cloud)· Aug 7, 2026

33. 7.5High

    CVE-2026-15972 ↗ (opens in a new tab)

    Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections, potentially preventing legitimate clients from connecting. This vulnerability, CVE-2026-15972, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

    HAHashiCorp (HCP / Terraform Cloud)· Aug 7, 2026

34. 4.2Med

    CVE-2026-15970 ↗ (opens in a new tab)

    Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This vulnerability, CVE-2026-15970, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

    HAHashiCorp (HCP / Terraform Cloud)· Aug 7, 2026

35. 8.6High

    CVE-2026-16328 ↗ (opens in a new tab)

    In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect the server's Consul API traffic to an attacker-controlled endpoint, potentially exfiltrating the Consul token configured on the server. This vulnerability, CVE-2026-16328, is fixed in consul-mcp-server 0.1.4.

    HAHashiCorp (HCP / Terraform Cloud)· Jul 29, 2026

36. 10.0Crit

    CVE-2026-16326 ↗ (opens in a new tab)

    In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.

    HAHashiCorp (HCP / Terraform Cloud)· Jul 29, 2026

37. 10.0Crit

    CVE-2026-16498 ↗ (opens in a new tab)

    The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0.

    HAHashiCorp (HCP / Terraform Cloud)· Jul 28, 2026

38. 8.9High

    CVE-2026-16496 ↗ (opens in a new tab)

    The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials. This vulnerability, CVE-2026-16496, is fixed in terraform-mcp-server 1.1.0.

    HAHashiCorp (HCP / Terraform Cloud)· Jul 28, 2026

39. 8.6High

    CVE-2026-14869 ↗ (opens in a new tab)

    The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the server-side authorization token, to an attacker-controlled endpoint. This vulnerability, CVE-2026-14869, is fixed in terraform-mcp-server 1.1.0.

    HAHashiCorp (HCP / Terraform Cloud)· Jul 28, 2026

40. 4.2Med

    CVE-2026-14896 ↗ (opens in a new tab)

    HashiCorp Nomad and Nomad Enterprise are vulnerable to a cross-namespace authorization bypass in the dynamic host volumes feature that may allow an operator holding the host volume delete permission in one namespace to delete a sticky volume claim belonging to a job in another namespace. This vulnerability, CVE-2026-14896, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.

    HAHashiCorp (HCP / Terraform Cloud)· Jul 8, 2026

41. 8.7High

    CVE-2026-14891 ↗ (opens in a new tab)

    HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job submitter to bind-mount a host path into a container even when volume bind mounts are disabled, potentially leading to reading and writing files on the host. This vulnerability, CVE-2026-14891, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.

    HAHashiCorp (HCP / Terraform Cloud)· Jul 8, 2026

42. 7.7High

    CVE-2026-14373 ↗ (opens in a new tab)

    HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's host namespace mode options. This may allow an authenticated job submitter to run a container in a host namespace and access information belonging to the host or to other workloads on the same client. This vulnerability, CVE-2026-14373, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.

    HAHashiCorp (HCP / Terraform Cloud)· Jul 8, 2026

43. 4.7Med

    CVE-2026-14361 ↗ (opens in a new tab)

    The consul-template library before version 0.42.1 is vulnerable to a path redirection issue in the writeToFile template helper that may allow template output to be written outside the intended directory or to overwrite an existing file. This vulnerability (CVE-2026-14361) is fixed in consul-template 0.42.1.

    HAHashiCorp (HCP / Terraform Cloud)· Jul 8, 2026

44. 4.9Med

    CVE-2026-14362 ↗ (opens in a new tab)

    HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.

    HAHashiCorp (HCP / Terraform Cloud)· Jul 8, 2026

45. 7.7High

    CVE-2026-14468 ↗ (opens in a new tab)

    HashiCorp Terraform Enterprise contained an issue in its version control system (VCS) ingestion of registry modules that did not correctly enforce the intended boundary on packaged module content. This may allow an authenticated user to include files from outside the intended repository content in a module and then download them, potentially exposing sensitive files readable by the ingestion process. This vulnerability, CVE-2026-14468, is fixed in Terraform Enterprise v2.0.4 and v1.2.4.

    HAHashiCorp (HCP / Terraform Cloud)· Jul 6, 2026

46. 4.4Med

    CVE-2026-5051 ↗ (opens in a new tab)

    HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used. This vulnerability (CVE-2026-5051) is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17.

    HAHashiCorp (HCP / Terraform Cloud)· Jul 1, 2026

47. 6.0Med

    CVE-2026-8052 ↗ (opens in a new tab)

    HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-8052) is fixed in version 0.1.2 of the exec2 task driver.

    HAHashiCorp (HCP / Terraform Cloud)· May 12, 2026

48. 8.8High

    CVE-2026-7474 ↗ (opens in a new tab)

    HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.

    HAHashiCorp (HCP / Terraform Cloud)· May 12, 2026

49. 6.0Med

    CVE-2026-6959 ↗ (opens in a new tab)

    HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-6959) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.

    HAHashiCorp (HCP / Terraform Cloud)· May 12, 2026

50. 4.7Med

    CVE-2026-5061 ↗ (opens in a new tab)

    The consul-template library before version 0.42.0 is vulnerable to a sandbox path bypass in the file template helper that may allow reading an out-of-sandbox file. This vulnerability (CVE-2026-5061) is fixed in consul-template 0.42.0.

    HAHashiCorp (HCP / Terraform Cloud)· May 12, 2026