The vulnerability of the PKI Vault platform for archiving corporate information, including HashiCorp Vault Community Edition and Vault Enterprise, allows a perpetrator to disclose confidential information.

🗓️ 01 Jul 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 12 Views

PKI Vault flaw in HashiCorp Vault Community and Enterprise allows confidential data disclosure due to insufficient server-side request validation.

Reporter	Title	Published	Views	Family All 25
ATTACKERKB	CVE-2026-5052	17 Apr 202602:55	–	attackerkb
IBM Security Bulletins	Security Bulletin: Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS	13 May 202620:12	–	ibm
Chainguard	CVE-2026-5052 vulnerabilities	2 Jul 202614:17	–	cgr
Circl	CVE-2026-5052	17 Apr 202606:07	–	circl
CNNVD	HashiCorp Vault和HashiCorp Vault Enterprise 安全漏洞	17 Apr 202600:00	–	cnnvd
CVE	CVE-2026-5052	17 Apr 202602:55	–	cve
Cvelist	CVE-2026-5052 Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS	17 Apr 202602:55	–	cvelist
EUVD	EUVD-2026-23344	17 Apr 202606:31	–	euvd
Github Security Blog	HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS	17 Apr 202606:31	–	github
HashiCorp Security Advisories	Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS	17 Apr 202602:54	–	hashicorp

Vulners

Node

OR

red_hat red_hat_openshift_dataMatch4

red_hat red_hat_openshift_container_platformMatch4

hashicorp vault_enterpriseMatch1.20.9

hashicorp vault_enterpriseMatch1.19.15

hashicorp vault_enterpriseRange<2.0.0

hashicorp vault_enterpriseRange<1.21.5

hashicorp vault_enterpriseRange<1.20.10

hashicorp vault_enterpriseRange<1.19.16

hashicorp vault_community_editionRange1.14.0–2.0.0

hashicorp vault_enterpriseRange1.14.0–1.21.4

Source	Link
discuss	www.discuss.hashicorp.com/t/hcsec-2026-06-vault-vulnerable-to-server-side-request-forgery-in-acme-challenge-validation-via-attacker-controlled-dns/77343
redos	www.redos.red-soft.ru/search/
access	www.access.redhat.com/security/cve/cve-2026-5052
web	www.web.nvd.nist.gov/view/vuln/detail

01 Jul 2026 00:00Current

5.7Medium risk

Vulners AI Score5.7

CVSS 27.8

CVSS 38.6

EPSS0.00332

public key vault vault community edition vault enterprise edition confidential data disclosure