CVEs.

Matching CVEs

1. 8.7High

   CVE-2026-13303 ↗ (opens in a new tab)

   HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue outbound requests to a network destination of the requester's choosing and to receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service. This vulnerability, CVE-2026-13303, is fixed in Boundary Enterprise 1.0.2 and 0.21.6.

   HAHashiCorp (HCP / Terraform Cloud)· Oct 29, 2026

2. 8.8High

   CVE-2026-119168 ↗ (opens in a new tab)

   HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

   HAHashiCorp (HCP / Terraform Cloud)· Oct 29, 2026

3. 8.4High

   CVE-2026-107347 ↗ (opens in a new tab)

   HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory. When the client agent runs as root, this could lead to code execution as root on the client host. This vulnerability (CVE-2026-107347) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

   HAHashiCorp (HCP / Terraform Cloud)· Oct 29, 2026

4. 7.5High

   CVE-2026-105765 ↗ (opens in a new tab)

   HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

   HAHashiCorp (HCP / Terraform Cloud)· Oct 26, 2026

5. 7.5High

   CVE-2026-105626 ↗ (opens in a new tab)

   HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

   HAHashiCorp (HCP / Terraform Cloud)· Oct 26, 2026

6. 8.8High

   CVE-2026-105608 ↗ (opens in a new tab)

   HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission. This vulnerability (CVE-2026-105608) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

   HAHashiCorp (HCP / Terraform Cloud)· Oct 26, 2026

7. 7.2High

   CVE-2026-89322 ↗ (opens in a new tab)

   Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy, potentially leading to privilege escalation. This vulnerability (CVE-2026-89322) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.

   HAHashiCorp (HCP / Terraform Cloud)· Oct 7, 2026

8. 8.0High

   CVE-2026-105816 ↗ (opens in a new tab)

   Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory configured, a privileged operator able to restore an Integrated Storage (Raft) snapshot may be able to execute arbitrary code on the Vault host. This vulnerability (CVE-2026-105816) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.

   HAHashiCorp (HCP / Terraform Cloud)· Oct 7, 2026

9. 7.1High

   CVE-2026-88021 ↗ (opens in a new tab)

   Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not authorized to access. When building Envoy RBAC rules to enforce Connect intentions, Consul did not correctly escape certain characters in service names, namespaces, and partitions, causing the generated authorization rules to match more broadly than intended. This vulnerability (CVE-2026-88021) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.

   HAHashiCorp (HCP / Terraform Cloud)· Sep 10, 2026

10. 7.7High

    CVE-2026-87993 ↗ (opens in a new tab)

    The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability (CVE-2026-87993) is fixed in consul-template 0.43.0.

    HAHashiCorp (HCP / Terraform Cloud)· Sep 10, 2026

11. 8.3High

    CVE-2026-87090 ↗ (opens in a new tab)

    Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node's catalog registration and take over its node identity. An attacker with a token granting node-write permission on any single node name may exploit this issue if they can obtain the node ID of a node they do not control. This vulnerability (CVE-2026-87090) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.

    HAHashiCorp (HCP / Terraform Cloud)· Sep 10, 2026

12. 7.1High

    CVE-2026-19589 ↗ (opens in a new tab)

    Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability (CVE-2026-19589) is fixed in Packer 1.16.0.

    HAHashiCorp (HCP / Terraform Cloud)· Aug 17, 2026

13. 8.2High

    CVE-2026-14886 ↗ (opens in a new tab)

    Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability (CVE-2026-14886) is fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20.

    HAHashiCorp (HCP / Terraform Cloud)· Aug 10, 2026

14. 7.5High

    CVE-2026-15972 ↗ (opens in a new tab)

    Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections, potentially preventing legitimate clients from connecting. This vulnerability, CVE-2026-15972, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

    HAHashiCorp (HCP / Terraform Cloud)· Aug 7, 2026

15. 8.6High

    CVE-2026-16328 ↗ (opens in a new tab)

    In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect the server's Consul API traffic to an attacker-controlled endpoint, potentially exfiltrating the Consul token configured on the server. This vulnerability, CVE-2026-16328, is fixed in consul-mcp-server 0.1.4.

    HAHashiCorp (HCP / Terraform Cloud)· Jul 29, 2026

16. 8.9High

    CVE-2026-16496 ↗ (opens in a new tab)

    The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials. This vulnerability, CVE-2026-16496, is fixed in terraform-mcp-server 1.1.0.

    HAHashiCorp (HCP / Terraform Cloud)· Jul 28, 2026

17. 8.6High

    CVE-2026-14869 ↗ (opens in a new tab)

    The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the server-side authorization token, to an attacker-controlled endpoint. This vulnerability, CVE-2026-14869, is fixed in terraform-mcp-server 1.1.0.

    HAHashiCorp (HCP / Terraform Cloud)· Jul 28, 2026

18. 8.7High

    CVE-2026-14891 ↗ (opens in a new tab)

    HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job submitter to bind-mount a host path into a container even when volume bind mounts are disabled, potentially leading to reading and writing files on the host. This vulnerability, CVE-2026-14891, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.

    HAHashiCorp (HCP / Terraform Cloud)· Jul 8, 2026

19. 7.7High

    CVE-2026-14373 ↗ (opens in a new tab)

    HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's host namespace mode options. This may allow an authenticated job submitter to run a container in a host namespace and access information belonging to the host or to other workloads on the same client. This vulnerability, CVE-2026-14373, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.

    HAHashiCorp (HCP / Terraform Cloud)· Jul 8, 2026

20. 7.7High

    CVE-2026-14468 ↗ (opens in a new tab)

    HashiCorp Terraform Enterprise contained an issue in its version control system (VCS) ingestion of registry modules that did not correctly enforce the intended boundary on packaged module content. This may allow an authenticated user to include files from outside the intended repository content in a module and then download them, potentially exposing sensitive files readable by the ingestion process. This vulnerability, CVE-2026-14468, is fixed in Terraform Enterprise v2.0.4 and v1.2.4.

    HAHashiCorp (HCP / Terraform Cloud)· Jul 6, 2026

21. 8.8High

    CVE-2026-7474 ↗ (opens in a new tab)

    HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.

    HAHashiCorp (HCP / Terraform Cloud)· May 12, 2026

22. 7.5High

    CVE-2026-7776 ↗ (opens in a new tab)

    Boundary Community Edition and Boundary Enterprise (“Boundary”) workers are vulnerable to a denial-of-service condition during node enrollment TLS handshakes. An attacker with network access to the worker authentication listener may open a connection and delay or withhold the client certificate during the TLS handshake, causing worker connection handling to block. This may prevent legitimate worker connections from being accepted or routed. This vulnerability, CVE-2026-7776, is fixed in Boundary 0.21.3, 0.20.3, 0.19.5.

    HAHashiCorp (HCP / Terraform Cloud)· May 4, 2026

23. 7.5High

    CVE-2026-5807 ↗ (opens in a new tab)

    Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate operators from completing these workflows. This vulnerability, CVE-2026-5807, is fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0.

    HAHashiCorp (HCP / Terraform Cloud)· Apr 17, 2026

24. 8.6High

    CVE-2026-5052 ↗ (opens in a new tab)

    Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

    HAHashiCorp (HCP / Terraform Cloud)· Apr 17, 2026

25. 8.8High

    CVE-2026-4525 ↗ (opens in a new tab)

    If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

    HAHashiCorp (HCP / Terraform Cloud)· Apr 17, 2026

26. 8.1High

    CVE-2026-3605 ↗ (opens in a new tab)

    An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

    HAHashiCorp (HCP / Terraform Cloud)· Apr 17, 2026

27. 7.5High

    CVE-2026-4660 ↗ (opens in a new tab)

    HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.

    HAHashiCorp (HCP / Terraform Cloud)· Apr 9, 2026

28. 8.8High

    CVE-2026-0969 ↗ (opens in a new tab)

    The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0.

    HAHashiCorp (HCP / Terraform Cloud)· Feb 12, 2026

29. 7.5High

    CVE-2025-12044 ↗ (opens in a new tab)

    Vault and Vault Enterprise (“Vault”) are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for [+HCSEC-2025-24+|https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393] which allowed for processing JSON payloads before applying rate limits. This vulnerability, CVE-2025-12044, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.16.27, 1.19.11, 1.20.5, and 1.21.0.

    HAHashiCorp (HCP / Terraform Cloud)· Oct 23, 2025

30. 8.1High

    CVE-2025-11621 ↗ (opens in a new tab)

    Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS accounts, or uses a wildcard. This vulnerability, CVE-2025-11621, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27

    HAHashiCorp (HCP / Terraform Cloud)· Oct 23, 2025

31. 7.5High

    CVE-2025-6203 ↗ (opens in a new tab)

    A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in excessive memory and CPU consumption of Vault. This may lead to a timeout in Vault’s auditing subroutine, potentially resulting in the Vault server to become unresponsive. This vulnerability, CVE-2025-6203, is fixed in Vault Community Edition 1.20.3 and Vault Enterprise 1.20.3, 1.19.9, 1.18.14, and 1.16.25.

    HAHashiCorp (HCP / Terraform Cloud)· Aug 28, 2025

32. 7.5High

    CVE-2025-8959 ↗ (opens in a new tab)

    HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9.

    HAHashiCorp (HCP / Terraform Cloud)· Aug 15, 2025

33. 8.1High

    CVE-2025-6013 ↗ (opens in a new tab)

    Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault Enterprise 1.20.2, 1.19.8, 1.18.13, and 1.16.24.

    HAHashiCorp (HCP / Terraform Cloud)· Aug 6, 2025

34. 7.2High

    CVE-2025-5999 ↗ (opens in a new tab)

    A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy. Fixed in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11 and 1.16.22.

    HAHashiCorp (HCP / Terraform Cloud)· Aug 1, 2025

35. 8.1High

    CVE-2025-4922 ↗ (opens in a new tab)

    Nomad Community and Nomad Enterprise (“Nomad”) prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14.

    HAHashiCorp (HCP / Terraform Cloud)· Jun 11, 2025

36. 7.6High

    CVE-2025-3744 ↗ (opens in a new tab)

    Nomad Enterprise (“Nomad”) jobs using the policy override option are bypassing the mandatory sentinel policies. This vulnerability, identified as CVE-2025-3744, is fixed in Nomad Enterprise 1.10.1, 1.9.9, and 1.8.13.

    HAHashiCorp (HCP / Terraform Cloud)· May 13, 2025

37. 8.8High

    CVE-2025-3879 ↗ (opens in a new tab)

    Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.

    HAHashiCorp (HCP / Terraform Cloud)· May 2, 2025

38. 8.2High

    CVE-2025-1293 ↗ (opens in a new tab)

    Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0.

    HAHashiCorp (HCP / Terraform Cloud)· Feb 20, 2025

39. 7.1High

    CVE-2025-0937 ↗ (opens in a new tab)

    Nomad Community and Nomad Enterprise ("Nomad") event stream configured with a wildcard namespace can bypass the ACL Policy allowing reads on other namespaces.

    HAHashiCorp (HCP / Terraform Cloud)· Feb 12, 2025