Description Summary:
HashiCorp Boundary workers are vulnerable to a denial-of-service condition during node enrollment TLS handshakes caused by unthrottled connection handling.

Executive Summary:
An unauthenticated denial-of-service vulnerability in HashiCorp Boundary workers allows remote attackers to disrupt node enrollment and routing through TLS handshake manipulation.

Vulnerability Details

CVE-ID: CVE-2026-7776

Affected Software: HashiCorp Boundary

Affected Versions: HashiCorp Boundary: 0.9.0 up to (excluding) 0.21.3; HashiCorp Boundary Enterprise: 0.9.0 up to (excluding) 0.21.3

Vulnerability: This issue is an allocation of resources without limits or throttling, classified as CWE-770. An unauthenticated attacker with network access to the worker authentication listener can withhold client certificates during the TLS handshake to block connection handling.

Business Impact

A successful exploit of this vulnerability results in a denial of service, preventing legitimate worker connections from being accepted or routed across the infrastructure. This disruption can halt administrative access workflows and impair remote session management capabilities. With a CVSS score of 7.5, the high severity rating reflects the ease of remote exploitation and the critical impact on service availability.

Remediation Plan

Immediate Action: Update HashiCorp Boundary Community Edition and Boundary Enterprise to version 0.21.3, 0.20.3, 0.19.5, or later.

Proactive Monitoring: Monitor network infrastructure and application logs for unusual spikes in pending TLS handshakes or dropped worker connections.

Compensating Controls: Restrict network access to the worker authentication listener to trusted IP addresses using firewalls or security groups until updates can be applied.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit or weaponized module currently exists in the available data).

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw presents a significant availability risk due to its unauthenticated network attack vector.

Analyst Recommendation

Security teams must prioritize updating HashiCorp Boundary deployments to the latest patched releases to mitigate availability risks. Applying these updates immediately ensures worker resilience against resource exhaustion during the TLS handshake phase.

Description Summary:
A path traversal vulnerability in HashiCorp Nomad and Nomad Enterprise allows authenticated users to access restricted directories, potentially leading to arbitrary code execution.

Executive Summary:
A critical path traversal vulnerability in HashiCorp Nomad allows authenticated attackers to escape restricted directories, leading to potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-7474

Affected Software: HashiCorp Nomad and Nomad Enterprise

Affected Versions: 1.10.0 up to 2.0.1

Vulnerability: This is a path traversal vulnerability (CWE-22) in the dynamic host volume implementation. It allows an authenticated user with sufficient permissions to manipulate file paths, potentially accessing or overwriting sensitive system files.

Business Impact

The ability to perform path traversal in a service orchestrator like Nomad is highly dangerous, as it can lead to full host compromise or arbitrary code execution. Given the CVSS score of 8.8, this vulnerability represents a significant threat to the security and stability of the entire infrastructure managed by the affected Nomad cluster.

Remediation Plan

Immediate Action: Upgrade to Nomad version 1.11.0-rc.1 (or the latest stable release) to address the path traversal flaw.

Proactive Monitoring: Monitor host file system access logs and Nomad task execution logs for attempts to access directories outside of defined volume mounts.

Compensating Controls: Restrict access to the Nomad API and ensure that job submissions are subject to strict policy enforcement and validation.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available in our curated sources.

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Due to the critical nature of orchestration platforms, the potential for exploitation is high if the environment is exposed to untrusted users.

Analyst Recommendation

Given that Nomad manages the lifecycle of applications across a cluster, a compromise here is catastrophic. Teams must prioritize patching this vulnerability to prevent attackers from escalating privileges and gaining control over the underlying infrastructure.

Description Summary:
An unauthenticated denial of service vulnerability in HashiCorp Vault allows attackers to exhaust the single in-progress operation slot by repeatedly initiating or canceling sensitive root operations.

Executive Summary:
HashiCorp Vault is vulnerable to a denial of service attack that allows an unauthenticated attacker to block critical administrative workflows, including root token generation and rekeying operations.

Vulnerability Details

CVE-ID: CVE-2026-5807

Affected Software: HashiCorp Vault

Affected Versions: HashiCorp Vault 0 up to (excluding) 2.0.0 and Vault Enterprise 0 up to (excluding) 2.0.0

Vulnerability: The vulnerability stems from an improper resource management flaw (CWE-770) where an unauthenticated attacker can occupy the single available in-progress operation slot. By repeatedly triggering or canceling specific administrative processes, the attacker prevents legitimate operators from performing sensitive maintenance tasks.

Business Impact

The ability for an unauthenticated user to halt critical security workflows poses a significant operational risk to organizations relying on Vault for secret management. Because this issue prevents root token generation and rekeying, it could hinder disaster recovery efforts or emergency administrative access. With a CVSS score of 7.5, this vulnerability is categorized as High, reflecting the potential for severe disruption to core infrastructure availability.

Remediation Plan

Immediate Action: Upgrade to Vault Community Edition 2.0.0 or Vault Enterprise 2.0.0 immediately to resolve this resource exhaustion flaw.

Proactive Monitoring: Monitor Vault audit logs for repeated, anomalous initiations or cancellations of root token generation and rekeying requests, which may indicate an attempt to trigger this denial of service condition.

Compensating Controls: Implement network-level access controls to restrict access to the Vault API to known, trusted management segments, thereby limiting the ability of external unauthenticated actors to reach the vulnerable endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is considered highly automatable, which increases the necessity of applying the patch promptly.

Analyst Recommendation

Given the ease with which this vulnerability can be exploited by an unauthenticated attacker, it represents a clear and present risk to service continuity. Security teams should prioritize the upgrade to version 2.0.0 across all environments. Failure to patch may leave critical administrative workflows susceptible to intentional disruption by unauthorized actors.

Description Summary:
HashiCorp’s go-getter library contains a vulnerability, potentially related to improper handling of remote resources, that could lead to security risks in dependent applications.

Executive Summary:
A high-severity vulnerability in HashiCorp's go-getter library requires immediate attention as it impacts multiple downstream products relying on this library for resource retrieval.

Vulnerability Details

CVE-ID: CVE-2026-4660

Affected Software: HashiCorp go-getter

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the go-getter library, which is commonly used to download remote files or directories. While specific details are limited, such flaws typically involve insecure handling of URLs or data during the retrieval process.

Business Impact

Because go-getter is a foundational library used by various infrastructure-as-code and orchestration tools, this vulnerability could lead to remote code execution or unauthorized file access in dependent applications. The CVSS score of 7.5 highlights the potential for severe security degradation across affected enterprise environments.

Remediation Plan

Immediate Action: Identify all internal applications and services that utilize the HashiCorp go-getter library and update them to the version specified in the vendor advisory.

Proactive Monitoring: Monitor for unexpected outbound network connections or file system modifications initiated by applications utilizing go-getter.

Compensating Controls: Implement egress filtering to prevent applications from fetching resources from untrusted or unknown external origins.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, the widespread use of this library in infrastructure tools makes the potential for exploitation high.

Analyst Recommendation

Given the central role of go-getter in HashiCorp and third-party tools, organizations should perform an immediate inventory of their software stack to identify affected dependencies. Prioritize patching to prevent potential remote exploitation of infrastructure management workflows.

Description Summary:
HashiCorp Vault may incorrectly forward sensitive authentication tokens to configured auth plugin backends when the Authorization header pass-through is enabled.

Executive Summary:
HashiCorp Vault contains a vulnerability that may expose sensitive authentication tokens to third-party auth plugins, creating a risk of unauthorized credential access.

Vulnerability Details

CVE-ID: CVE-2026-4525

Affected Software: HashiCorp Vault and Vault Enterprise

Affected Versions: 0.11.2 through 1.21.4 (and other versions prior to 2.0.0, 1.21.5, 1.20.10, or 1.19.16)

Vulnerability: This is an insertion of sensitive information into sent data (CWE-201) occurring when Vault is configured to pass through the Authorization header. An authenticated user can trigger this behavior, causing the system to leak the active Vault token to the plugin backend during the authentication process.

Business Impact

The potential for token exposure represents a significant security risk, as compromised tokens allow an attacker to impersonate legitimate users or service accounts. Given the CVSS score of 7.5, this high-severity flaw could lead to full unauthorized access within the Vault environment, potentially resulting in the exfiltration of secrets, encryption keys, or sensitive configuration data.

Remediation Plan

Immediate Action: Upgrade HashiCorp Vault or Vault Enterprise to version 2.0.0, 1.21.5, 1.20.10, or 1.19.16 to ensure proper header sanitization.

Proactive Monitoring: Review audit logs for unusual auth plugin activity or unexpected requests originating from internal plugin backends that may indicate token interception attempts.

Compensating Controls: If patching is not immediately feasible, disable the Authorization header pass-through feature for any auth mounts where sensitive tokens are utilized for authentication.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires the specific configuration of an auth mount to pass through headers, the impact is severe, necessitating prompt action to prevent potential credential theft.

Analyst Recommendation

This vulnerability presents a clear risk to the integrity of authentication workflows within HashiCorp Vault. Organizations should prioritize the application of the provided security patches to eliminate the possibility of token leakage. Verify your current Vault configuration to determine if Authorization header pass-through is in use and apply the update immediately to maintain a secure posture.

Description Summary:
An authenticated user with specific policy permissions can bypass authorization checks to delete secrets in Vault kvv2 paths, leading to a denial of service.

Executive Summary:
HashiCorp Vault contains an authorization bypass vulnerability that allows authenticated users to perform unauthorized deletions of sensitive secrets, resulting in service disruption.

Vulnerability Details

CVE-ID: CVE-2026-3605

Affected Software: HashiCorp Vault

Affected Versions: HashiCorp Vault 0.10.0 up to (excluding) 2.0.0; specific enterprise versions 1.19.16, 1.20.10, and 1.21.5.

Vulnerability: This vulnerability involves a flaw in policy enforcement where an authenticated user with access to a kvv2 path via a glob pattern can delete secrets they are not explicitly permitted to read or write. The issue is classified under CWE-288, indicating an authentication bypass using an alternate path or channel.

Business Impact

The vulnerability carries a CVSS score of 8.1, reflecting a high impact on system availability and integrity. Successful exploitation could lead to significant operational downtime as attackers delete critical secrets, potentially halting automated workflows or application deployments that rely on Vault for credential management. While the flaw does not permit reading secret data or cross-namespace deletion, the resulting denial of service poses a severe threat to business continuity.

Remediation Plan

Immediate Action: Upgrade to Vault Community Edition 2.0.0, or for Enterprise users, upgrade to versions 2.0.0, 1.21.5, 1.20.10, or 1.19.16 as provided by the vendor.

Proactive Monitoring: Review Vault audit logs for suspicious deletion patterns, specifically targeting requests originating from users with glob-based policy access.

Compensating Controls: Restrict access to policies utilizing glob patterns to the minimum set of users required and ensure that administrative oversight is applied to any policy changes involving sensitive KV secret engines.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit or proof-of-concept available for this vulnerability.

Analyst Notes: As of April 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is limited to authenticated users with existing policy access, which inherently reduces the attack surface compared to unauthenticated remote code execution vulnerabilities.

Analyst Recommendation

Given the high CVSS severity and the potential for disruptive denial of service, organizations should prioritize patching their Vault instances. Administrators must verify their current version against the fixed releases and apply the necessary security updates to prevent unauthorized secret deletion. If immediate patching is not feasible, restrict the scope of policies using glob patterns to limit the potential impact until the update can be deployed.

Description Summary:
A cross-tenant credential reuse vulnerability in HashiCorp terraform-mcp-server before 1.1.0 allows unauthorized access to tool calls by using a previous user's Terraform token.

Executive Summary:
A critical credential reuse vulnerability in HashiCorp terraform-mcp-server allows unauthorized users to impersonate others and execute tool calls, compromising tenant isolation.

Vulnerability Details

CVE-ID: CVE-2026-16498

Affected Software: HashiCorp Terraform MCP Server

Affected Versions: 0.3.0 up to (excluding) 1.1.0

Vulnerability: The software fails to properly isolate credentials in the streamable-HTTP stateless transport mode. This allows an unauthenticated attacker to reuse a session token from one user to execute actions on behalf of another user, violating tenant boundaries.

Business Impact

The CVSS score of 10.0 highlights the extreme severity of this flaw, as it allows for full unauthorized access across tenant boundaries. This could result in complete data exposure, unauthorized modification of infrastructure, and significant reputational damage to organizations relying on the affected software for sensitive operations.

Remediation Plan

Immediate Action: Update the terraform-mcp-server to version 1.1.0 or later immediately to resolve the credential reuse issue.

Proactive Monitoring: Review audit logs for suspicious tool calls or sessions that appear to originate from incorrect user contexts or unexpected IP addresses.

Compensating Controls: Disable the streamable-HTTP stateless transport mode if the update cannot be applied immediately, as this is the specific vector for the vulnerability.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is a design-level issue involving session management.

Analyst Recommendation

This vulnerability represents a total loss of tenant isolation and must be addressed with the highest priority. Administrators should apply the patch to version 1.1.0 without delay to prevent potential cross-tenant credential abuse.

Description Summary:
The HashiCorp Terraform MCP server contains a session fixation vulnerability that may allow attackers to hijack user sessions.

Executive Summary:
HashiCorp Terraform MCP Server is affected by a session fixation vulnerability that could allow unauthorized access to authenticated user sessions.

Vulnerability Details

CVE-ID: CVE-2026-16496

Affected Software: HashiCorp Terraform MCP Server

Affected Versions: 0.3.0 up to 1.1.0

Vulnerability: This is a session fixation vulnerability (CWE-384) where the application fails to properly regenerate or invalidate session identifiers upon authentication. The attack vector is remote and requires high complexity to execute, but it does not require prior authentication.

Business Impact

A session fixation attack can result in the total compromise of user accounts, enabling attackers to gain unauthorized access to sensitive infrastructure management tools. Given the CVSS score of 8.9, this vulnerability represents a critical threat to internal security and administrative control over HashiCorp-managed environments.

Remediation Plan

Immediate Action: Upgrade to the latest version of the Terraform MCP server that includes the fix for session handling as documented in the vendor advisory.

Proactive Monitoring: Review authentication logs and session management patterns for anomalies, such as multiple users sharing the same session identifier.

Compensating Controls: Ensure that all sessions are terminated and re-issued upon login and enforce short session timeouts to limit the window of opportunity for an attacker.

Exploitation Status

Public Exploit Available: No confirmed public exploit available.

Analyst Notes: As of July 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the exploit complexity is high, the impact of a session fixation flaw in a server managing infrastructure makes this a high-priority item for remediation.

Analyst Recommendation

Security teams should treat this vulnerability with urgency due to the potential for administrative account takeover. It is recommended to apply the vendor-provided patch immediately and audit current session management configurations to ensure compliance with secure development practices.

Description Summary:
The HashiCorp consul-mcp-server is vulnerable to Server-Side Request Forgery (SSRF), allowing unauthenticated attackers to potentially access unauthorized internal resources.

Executive Summary:
A Server-Side Request Forgery vulnerability in the HashiCorp consul-mcp-server allows unauthenticated remote attackers to perform unauthorized requests against internal services.

Vulnerability Details

CVE-ID: CVE-2026-16328

Affected Software: HashiCorp consul-mcp-server

Affected Versions: 0.1.0 up to (excluding) 0.1.4

Vulnerability: The application is susceptible to Server-Side Request Forgery (CWE-918) due to improper validation of user-supplied input. This vulnerability allows an unauthenticated attacker to force the server to make requests to arbitrary locations, effectively bypassing network access controls.

Business Impact

With a CVSS score of 8.6, this vulnerability poses a significant risk to internal infrastructure security. An attacker can leverage this flaw to probe internal networks, access sensitive metadata endpoints, or interact with services that are not exposed to the public internet, potentially leading to data exfiltration or further unauthorized access.

Remediation Plan

Immediate Action: Update the consul-mcp-server to version 0.1.4 or later to apply the necessary security fixes provided by HashiCorp.

Proactive Monitoring: Review application logs for suspicious outbound network requests originating from the consul-mcp-server, particularly those directed toward internal IP ranges or sensitive cloud metadata services.

Compensating Controls: Implement strict egress filtering at the network level to prevent the server from initiating unauthorized connections to internal resources.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. SSRF vulnerabilities are frequently used by attackers to map internal environments and gain unauthorized access to cloud environment credentials.

Analyst Recommendation

The high severity of this SSRF vulnerability necessitates an immediate update to the patched version. Organizations utilizing consul-mcp-server should treat this as a high-priority remediation to prevent potential lateral movement and unauthorized access to internal services.

Description Summary:
The HashiCorp consul-mcp-server fails to isolate session state in stateless mode, allowing one client's authentication token to be erroneously reused by other clients.

Executive Summary:
A critical session isolation vulnerability in HashiCorp consul-mcp-server exposes sensitive authentication tokens, allowing cross-client impersonation.

Vulnerability Details

CVE-ID: CVE-2026-16326

Affected Software: HashiCorp consul-mcp-server

Affected Versions: 0.1.0 through 0.1.3

Vulnerability: The application does not properly isolate session state in stateless mode, which allows for the leakage of authentication tokens between different clients. This is an unauthenticated vulnerability that impacts the confidentiality and integrity of the session management process.

Business Impact

With a CVSS score of 10.0, this vulnerability represents the highest level of risk. Successful exploitation allows an attacker to hijack the sessions of other users or gain unauthorized access to resources by assuming the identity of another client, potentially leading to a complete compromise of the Consul environment.

Remediation Plan

Immediate Action: Upgrade the consul-mcp-server component to version 0.1.4 or later to ensure proper session isolation.

Proactive Monitoring: Audit access logs for suspicious token usage patterns where a single token appears to be associated with multiple distinct client identities or IP addresses.

Compensating Controls: Implement strict network-level access controls to limit the exposure of the consul-mcp-server until the patch can be deployed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently critical due to the direct impact on authentication and authorization controls.

Analyst Recommendation

This vulnerability demands immediate attention due to its potential for total session compromise. Administrators must prioritize updating the consul-mcp-server software to the fixed version to prevent unauthorized impersonation and potential data breaches within the HashiCorp ecosystem.

Description Summary:
HashiCorp Consul is vulnerable to an uncontrolled resource consumption issue due to inadequate limits on resource allocation, potentially leading to denial of service.

Executive Summary:
A high severity resource exhaustion vulnerability in HashiCorp Consul allows unauthenticated attackers to cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-15972

Affected Software: HashiCorp Consul

Affected Versions: HashiCorp Consul 1.13.0 up to (excluding) 2.0.3, HashiCorp Consul Enterprise 1.13.0 up to (excluding) 2.0.3

Vulnerability: This vulnerability involves a failure to properly limit or throttle resource allocation (CWE-770). An unauthenticated attacker can exploit this to exhaust system resources, resulting in a denial of service for the affected Consul instance.

Business Impact

Successful exploitation of this flaw can result in significant service disruption, as Consul is a critical component for service discovery and configuration management in many distributed environments. With a CVSS score of 7.5, the vulnerability poses a high risk to availability, potentially causing cascading failures in dependent microservices and infrastructure components.

Remediation Plan

Immediate Action: Update both Consul and Consul Enterprise instances to version 2.0.3 or later immediately.

Proactive Monitoring: Monitor system resource metrics, such as CPU and memory usage, for sudden spikes that may indicate exploitation attempts.

Compensating Controls: Implement network access controls to restrict access to the Consul API to known, trusted management nodes.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ability to be triggered by unauthenticated remote requests.

Analyst Recommendation

Given the critical role Consul plays in infrastructure availability, administrators must prioritize patching this vulnerability. Apply the update to version 2.0.3 across all production environments to prevent potential service outages caused by resource exhaustion.

Description Summary:
A sandbox escape vulnerability in the HashiCorp Nomad Docker task driver allows job submitters to bind-mount host paths, enabling unauthorized read/write access to the host filesystem.

Executive Summary:
A high-severity sandbox escape in the HashiCorp Nomad Docker task driver allows privileged users to bypass file access restrictions and compromise the host system.

Vulnerability Details

CVE-ID: CVE-2026-14891

Affected Software: HashiCorp Nomad / Nomad Enterprise

Affected Versions: 0.4.1 up to (excluding) 2.0.4

Vulnerability: This vulnerability, identified as an improper link resolution issue, allows a job submitter to bind-mount a host path into a container even when such actions are disabled. The attacker must possess high-level privileges to submit jobs to the cluster.

Business Impact

Successful exploitation allows an attacker to read or modify files on the host machine, effectively breaking the isolation layer between the container and the underlying infrastructure. With a CVSS score of 8.7, this vulnerability represents a severe threat to the security of containerized environments and the underlying host nodes.

Remediation Plan

Immediate Action: Upgrade HashiCorp Nomad and Nomad Enterprise to version 2.0.4 or later immediately.

Proactive Monitoring: Review audit logs for unusual job submissions or attempts to access restricted host paths via the Docker task driver.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) to limit which users can submit jobs to the Nomad cluster, thereby reducing the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for complete host compromise, upgrading to the patched version is the only effective mitigation. Security teams should treat this as an urgent infrastructure update to maintain the integrity of the Nomad cluster.

Description Summary:
HashiCorp Vault Enterprise is vulnerable to a cross-namespace authorization bypass that allows authenticated users to delete entity storage backing in unauthorized namespaces.

Executive Summary:
A high-severity authorization bypass in HashiCorp Vault Enterprise allows authenticated users to perform unauthorized deletions of entity storage across namespace boundaries.

Vulnerability Details

CVE-ID: CVE-2026-14886

Affected Software: HashiCorp Vault Enterprise

Affected Versions: 2.0.0 up to (excluding) 2.0.4

Vulnerability: This is a missing authorization flaw (CWE-862) occurring within the identity entity batch-delete endpoint. An authenticated caller with permissions in one namespace can manipulate requests to delete critical identity data in separate, restricted namespaces.

Business Impact

Successful exploitation results in the permanent loss of identity storage, which can lead to significant service disruption and denial of service for dependent applications. Given the CVSS score of 8.2, this vulnerability poses a high risk to organizational data integrity and availability, potentially causing widespread operational impact if identity entities are purged.

Remediation Plan

Immediate Action: Update HashiCorp Vault Enterprise to version 2.0.4 or later to resolve the authorization logic flaw.

Proactive Monitoring: Review Vault access and audit logs for unusual batch-delete operations or unexpected administrative activity across namespace boundaries.

Compensating Controls: Restrict access to the identity entity batch-delete endpoint through granular Role-Based Access Control policies until patches are applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its impact on storage integrity and the potential for cross-namespace escalation.

Analyst Recommendation

The severity of this flaw necessitates immediate attention. Administrators must prioritize updating Vault Enterprise to the latest version to prevent unauthorized data loss and ensure that administrative actions remain confined to their intended scopes.

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability exists in the HashiCorp Terraform MCP Server, allowing remote attackers to send unauthorized requests to internal resources.

Executive Summary:
A critical SSRF vulnerability in HashiCorp Terraform MCP Server exposes internal network infrastructure to unauthorized request manipulation.

Vulnerability Details

CVE-ID: CVE-2026-14869

Affected Software: HashiCorp Terraform MCP Server

Affected Versions: 0.3.0 up to (excluding) 1.1.0

Vulnerability: The application is vulnerable to Server-Side Request Forgery (SSRF), allowing an unauthenticated attacker to manipulate the server into making requests to unauthorized or internal network locations.

Business Impact

SSRF vulnerabilities can be used to bypass internal firewalls, scan internal networks, or interact with sensitive metadata services. With a CVSS score of 8.6, the risk of lateral movement or information disclosure within the environment is high.

Remediation Plan

Immediate Action: Upgrade to version 1.1.0 or later as recommended by HashiCorp to mitigate this SSRF risk.

Proactive Monitoring: Monitor server outbound traffic for connections to internal IP ranges or services that the Terraform MCP Server should not be accessing.

Compensating Controls: Implement strict egress filtering on the server to prevent it from initiating requests to sensitive internal endpoints or metadata services.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Per CISA's SSVC assessment, there is no confirmed active exploitation in the wild.

Analyst Recommendation

Organizations should prioritize the update to version 1.1.0 to ensure the vulnerability is fully remediated. Given the potential for internal network discovery and unauthorized access, immediate patching is recommended to secure the environment against potential SSRF exploitation.

Description Summary:
A path traversal vulnerability in HashiCorp Terraform Enterprise during VCS registry module ingestion allows for unauthorized file reads.

Executive Summary:
A high-severity path traversal vulnerability in HashiCorp Terraform Enterprise allows authenticated users to read arbitrary files from the server.

Vulnerability Details

CVE-ID: CVE-2026-14468

Affected Software: HashiCorp Terraform Enterprise

Affected Versions: 1.0.0 up to 2.0.4

Vulnerability: This is an Improper Limitation of a Pathname to a Restricted Directory (CWE-22) issue within the Version Control System (VCS) ingestion process. An authenticated attacker can manipulate module content to read sensitive files outside of the intended directory boundaries.

Business Impact

With a CVSS score of 7.7, this vulnerability poses a critical risk to data confidentiality. Unauthorized access to arbitrary files can lead to the exposure of sensitive configuration data, credentials, or environment variables, potentially facilitating further lateral movement or full system compromise within the Terraform Enterprise environment.

Remediation Plan

Immediate Action: Update Terraform Enterprise to the latest version (2.0.4 or higher) where the path validation logic has been corrected.

Proactive Monitoring: Audit access logs for unusual file read operations and monitor the VCS ingestion pipeline for malformed or suspicious module packages.

Compensating Controls: Restrict access to the VCS ingestion functionality to trusted users only and ensure the application runs with the principle of least privilege regarding file system permissions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to read arbitrary files presents a severe risk in enterprise environments. Organizations should prioritize patching their Terraform Enterprise instances and conduct a thorough review of environment logs to ensure no unauthorized file access has occurred.

Description Summary:
The serialize function in next-mdx-remote fails to properly sanitize MDX content, allowing authenticated attackers to execute arbitrary code during the compilation process.

Executive Summary:
A critical code injection vulnerability in the next-mdx-remote library allows authenticated attackers to achieve remote code execution on the underlying server.

Vulnerability Details

CVE-ID: CVE-2026-0969

Affected Software: HashiCorp next-mdx-remote

Affected Versions: 4.3.0 up to (excluding) 6.0.0

Vulnerability: The vulnerability is caused by improper control of code generation (CWE-94) within the serialize function. Attackers with low-level privileges can supply malicious MDX content that is executed by the server during the rendering process.

Business Impact

This vulnerability carries a CVSS score of 8.8, indicating a high risk to organizational security. Successful exploitation grants an attacker the ability to execute arbitrary code with the privileges of the application, potentially leading to full system compromise, unauthorized data access, and the ability to pivot into internal networks.

Remediation Plan

Immediate Action: Update the next-mdx-remote package to version 6.0.0 or later to ensure the serialize function correctly sanitizes input.

Proactive Monitoring: Review application logs for suspicious MDX input patterns or unexpected process execution spawned by the web server.

Compensating Controls: Implement strict input validation or use a Web Application Firewall (WAF) configured to inspect and block malicious MDX payloads before they reach the backend serialization logic.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of February 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the risk of remote code execution is severe, the requirement for authenticated access limits the immediate attack surface to internal users or compromised accounts.

Analyst Recommendation

Given the severity of potential remote code execution, organizations should prioritize the update to next-mdx-remote 6.0.0. Testing should be conducted in a staging environment to ensure the security patch does not impact existing MDX rendering workflows, followed by a rapid deployment to production systems.

Description Summary:
A resource exhaustion vulnerability in HashiCorp Vault allows unauthenticated attackers to cause a denial of service via specially crafted JSON payloads.

Executive Summary:
HashiCorp Vault is vulnerable to a denial of service attack where unauthenticated users can trigger excessive resource consumption, leading to server unresponsiveness.

Vulnerability Details

CVE-ID: CVE-2025-6203

Affected Software: HashiCorp Vault

Affected Versions: HashiCorp Vault: 1.15.0 up to (excluding) 1.21.0; HashiCorp Vault Enterprise: 1.15.0 up to (excluding) 1.21.2

Vulnerability: This vulnerability, categorized as CWE-770, involves the allocation of resources without proper limits. An unauthenticated attacker can submit a complex JSON payload that triggers excessive memory and CPU usage, causing a timeout in the auditing subroutine and rendering the Vault server unresponsive.

Business Impact

The exploitation of this vulnerability directly threatens the availability of HashiCorp Vault, which is a critical component for managing secrets and sensitive data. With a CVSS score of 7.5, the risk is high because the attack is network-exploitable, requires no authentication, and can lead to a complete service outage. Such a disruption could halt dependent applications and services that rely on Vault for runtime secrets, leading to significant operational downtime.

Remediation Plan

Immediate Action: Upgrade to the patched versions: Vault Community Edition 1.20.3 or the relevant Enterprise releases (1.20.3, 1.19.9, 1.18.14, or 1.16.25).

Proactive Monitoring: Monitor server CPU and memory utilization metrics for sudden spikes and review audit logs for anomalous request patterns or recurring timeouts.

Compensating Controls: Implement a Web Application Firewall (WAF) or an API gateway to inspect and filter incoming JSON payloads for excessive complexity or size before they reach the Vault server.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 29, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its automatable nature and lack of authentication requirements, making it a prime candidate for automated denial of service attempts.

Analyst Recommendation

Given the critical role of Vault in infrastructure security and the high severity of this denial of service flaw, administrators must prioritize the application of the vendor-provided updates. Failure to patch leaves the environment susceptible to service disruption from unauthenticated network actors. Proceed with testing and deployment of the identified fixed versions in your production environment immediately.

Description Summary:
A privileged Vault operator can achieve remote code execution on the underlying host by leveraging specific audit configuration settings and a plugin directory.

Executive Summary:
A critical vulnerability in HashiCorp Vault allows an authenticated operator with high privileges to execute arbitrary code on the underlying host system, posing a severe security risk.

Vulnerability Details

CVE-ID: CVE-2025-6000

Affected Software: HashiCorp Vault

Affected Versions: HashiCorp Vault 0.8.0 up to (excluding) 1.20.1; HashiCorp Vault Enterprise 0.8.0 up to (excluding) 1.20.1

Vulnerability: The vulnerability involves improper control of code generation (CWE-94) where a privileged operator with write access to the audit system can trigger code execution if a plugin directory is configured. This requires high-level administrative privileges within the root namespace.

Business Impact

Successful exploitation grants an attacker full control over the host server running the Vault instance. Given the critical 9.1 CVSS score, this vulnerability could lead to a total compromise of sensitive secrets, encryption keys, and internal infrastructure, potentially resulting in catastrophic data breaches and loss of operational integrity.

Remediation Plan

Immediate Action: Upgrade to HashiCorp Vault Community Edition 1.20.1, or to the appropriate Enterprise versions (1.20.1, 1.19.7, 1.18.12, or 1.16.23) immediately.

Proactive Monitoring: Review Vault audit logs for suspicious changes to the plugin directory configuration or unauthorized attempts to modify sys/audit settings.

Compensating Controls: Restrict administrative access to the root namespace to the absolute minimum number of personnel and ensure that the plugin directory is not writable by unauthorized users.

Exploitation Status

Public Exploit Available: exploit_available (unknown)

Analyst Notes: As of Aug 1, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires high privileges, the ability to escape into the host environment makes this a critical security concern that requires immediate attention.

Analyst Recommendation

This vulnerability represents a significant risk to the integrity of the entire secrets management platform. Administrators must prioritize applying the provided patches to prevent potential host-level compromise. Failure to update leaves the infrastructure vulnerable to internal actors or compromised accounts capable of escalating privileges to the host operating system.

Description Summary:
A privilege escalation vulnerability in HashiCorp Vault allows an authenticated operator with specific permissions to elevate token privileges to the root policy.

Executive Summary:
A high-severity privilege escalation vulnerability in HashiCorp Vault allows authorized operators to gain unauthorized root policy access, posing a significant risk to secret management integrity.

Vulnerability Details

CVE-ID: CVE-2025-5999

Affected Software: HashiCorp Vault

Affected Versions: HashiCorp Vault 0.10.4 up to (excluding) 1.20.0; HashiCorp Vault Enterprise 0.10.4 up to (excluding) 1.20.0

Vulnerability: The vulnerability is an instance of incorrect privilege assignment (CWE-266) located within the identity endpoint of the root namespace. An authenticated user with existing write permissions to this endpoint can manipulate token privileges to acquire the root policy.

Business Impact

This vulnerability carries a CVSS score of 7.2, indicating a high risk of unauthorized administrative control. Successful exploitation allows an attacker to bypass intended access controls, potentially resulting in full compromise of all secrets, credentials, and encryption keys managed by the affected Vault instance. Such a breach could lead to widespread system compromise, data theft, and severe regulatory non-compliance.

Remediation Plan

Immediate Action: Upgrade to Vault Community Edition 1.20.0 or the corresponding fixed Enterprise versions: 1.20.0, 1.19.6, 1.18.11, or 1.16.22.

Proactive Monitoring: Review Vault audit logs for suspicious activity involving the identity endpoint and monitor for unauthorized changes to token policies or unexpected assignments of root-level permissions.

Compensating Controls: Restrict administrative access to the root namespace identity endpoint to the absolute minimum number of trusted users until the patch can be applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 1, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the exploit requires existing high-level privileges, the ability to escalate to root policy makes this a critical concern for secure infrastructure environments.

Analyst Recommendation

Given the potential for total loss of confidentiality and integrity within the Vault environment, administrators should prioritize this update. Ensure that all instances, including Enterprise deployments, are moved to the patched versions immediately to prevent malicious escalation by internal actors or compromised accounts.

Description Summary:
The Vault Terraform Provider incorrectly defaults the LDAP auth method deny_null_bind parameter to false, which may allow authentication bypass if the underlying LDAP server permits null binds.

Executive Summary:
A security misconfiguration in the HashiCorp Vault Terraform Provider could allow unauthenticated users to bypass LDAP authentication, posing a critical risk to identity security.

Vulnerability Details

CVE-ID: CVE-2025-13357

Affected Software: HashiCorp Vault Terraform Provider

Affected Versions: 4.2.0 up to (excluding) 5.5.0

Vulnerability: This vulnerability involves an insecure default configuration where the deny_null_bind parameter is set to false. An unauthenticated attacker could potentially leverage this to bypass authentication mechanisms if the backend LDAP server is configured to accept anonymous or null binds.

Business Impact

The exploitation of this vulnerability could lead to unauthorized access to sensitive systems or data protected by Vault, resulting in significant security breaches. Given the CVSS score of 7.4, this represents a high risk to organizational integrity, as it undermines the primary authentication gateway for infrastructure management.

Remediation Plan

Immediate Action: Upgrade the HashiCorp Vault Terraform Provider to version 5.5.0 or later to ensure the default security settings are correctly applied.

Proactive Monitoring: Review LDAP authentication logs for anomalous bind attempts, specifically looking for null or empty credentials associated with administrative or service accounts.

Compensating Controls: Ensure that the backend LDAP server is configured to explicitly reject anonymous or null binds, providing a defense-in-depth layer regardless of the client-side configuration.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of November 21, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is fundamentally an initialization error, which creates a persistent vulnerability in environments where the provider is deployed with default settings.

Analyst Recommendation

The reliance on insecure defaults makes this a high-priority update for any organization utilizing the Vault Terraform Provider. Administrators should verify their current provider versions immediately and execute the upgrade to 5.5.0 to remediate the potential authentication bypass vector.

Description Summary:
HashiCorp Vault is susceptible to an unauthenticated denial of service vulnerability triggered by the processing of complex JSON payloads due to a rate limiting regression.

Executive Summary:
HashiCorp Vault and Vault Enterprise are vulnerable to an unauthenticated denial of service attack that can be triggered by remote, unauthorized actors via malicious JSON payloads.

Vulnerability Details

CVE-ID: CVE-2025-12044

Affected Software: HashiCorp Vault

Affected Versions: HashiCorp Vault 1.20.3 up to 1.21.0; Vault Enterprise 1.20.3-1.20.4, 1.19.9-1.19.10, 1.18.14, and 1.16.25-1.16.26.

Vulnerability: The vulnerability stems from an improper resource allocation (CWE-770) where JSON payloads are processed before rate limits are applied, allowing an unauthenticated attacker to cause a service crash.

Business Impact

A successful exploitation of this vulnerability results in a denial of service, rendering the Vault instance unavailable for legitimate users and applications. Given a CVSS score of 7.5, this represents a high-severity risk to business continuity, as Vault is often a critical component for managing secrets and sensitive credentials across infrastructure. The ability for unauthenticated actors to trigger this state remotely necessitates immediate attention to prevent operational disruption.

Remediation Plan

Immediate Action: Upgrade to HashiCorp Vault Community Edition 1.21.0 or the corresponding fixed Enterprise versions: 1.16.27, 1.19.11, 1.20.5, or 1.21.0.

Proactive Monitoring: Monitor system logs for unusual spikes in request frequency or recurring service restarts that may indicate attempted exploitation of the JSON parsing engine.

Compensating Controls: Implement Web Application Firewall (WAF) rules to inspect and filter complex or malformed JSON payloads directed at the Vault API endpoints, though this should be considered a temporary measure pending a software update.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of October 24, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable due to the lack of authentication required to initiate the resource-intensive request processing.

Analyst Recommendation

The risk posed by this vulnerability is significant due to the critical nature of Vault in enterprise environments and the ease with which an unauthenticated actor can trigger a denial of service. Security teams should prioritize patching affected instances immediately. If an immediate upgrade is not feasible, restrict network access to the Vault API to known, trusted IP ranges to reduce the attack surface.

Description Summary:
A flaw in HashiCorp Vault's AWS Auth method allows an authenticated user to bypass authentication restrictions when specific IAM principal configurations are used.

Executive Summary:
HashiCorp Vault and Vault Enterprise are vulnerable to an authentication bypass within the AWS Auth method, potentially allowing unauthorized access to sensitive secrets.

Vulnerability Details

CVE-ID: CVE-2025-11621

Affected Software: HashiCorp Vault

Affected Versions: 0.6.0 up to (excluding) 1.21.0

Vulnerability: This is an authentication bypass vulnerability (CWE-288) occurring in the AWS Auth method. It is triggered when the bound_principal_iam role is reused across AWS accounts or utilizes wildcards, allowing an authenticated user with low privileges to escalate access.

Business Impact

The exploitation of this vulnerability poses a severe risk to organizational security, as it facilitates unauthorized access to the secrets managed by Vault. Given the CVSS score of 8.1, the impact is considered high, as it threatens the confidentiality and integrity of infrastructure credentials. Successful exploitation could lead to widespread unauthorized access across integrated cloud environments, resulting in significant data exposure and potential regulatory non-compliance.

Remediation Plan

Immediate Action: Update HashiCorp Vault Community Edition to version 1.21.0 or apply the corresponding enterprise fix (1.21.0, 1.20.5, 1.19.11, or 1.16.27) immediately.

Proactive Monitoring: Review Vault access logs for suspicious authentication patterns, specifically focusing on AWS Auth method requests involving wildcard principal configurations or cross-account role usage.

Compensating Controls: Limit the use of wildcard patterns in IAM principal definitions and ensure strict isolation between AWS accounts to reduce the attack surface until patches are deployed.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of October 24, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires specific environmental configurations to be exploitable, but it remains a critical concern for those relying on AWS-based authentication.

Analyst Recommendation

This vulnerability represents a significant security oversight in the AWS Auth integration for HashiCorp Vault. Organizations should prioritize the upgrade path provided by HashiCorp to ensure that authentication bypass vectors are effectively neutralized. Failure to patch may leave your centralized secret management infrastructure exposed to unauthorized access, making immediate action essential to maintaining your security posture.