Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: HashiCorp Vault 2.1.2 Clear all filters
TI-2026-69326 CVE-2026-89322 · GHSA-j78r-9xrv-vxf6

HashiCorp Vault ACL policy checks can bypass explicit deny rules

Priority LOW 33

Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00295 Published 2026-10-07 Fixed in 2.1.2 CWE-178
TI-2026-69328 CVE-2026-105816 · GHSA-pw8v-gjgv-3j42

Path traversal in HashiCorp Vault plugin catalog allows code execution

Priority LOW 37

Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory.

CVSS 3.1HIGH 8.0 Network High privileges No interaction EPSS 0.00335 Published 2026-10-07 Partial fix · 2.1.2 CWE-22
TI-2026-69320 CVE-2026-105818 · GHSA-fxww-hx7x-vxpc

Vault PKI ACME server issues certificates with unvalidated identities

Priority LOW 25

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.0008 Published 2026-10-07 Fixed in 2.1.2 CWE-345