CVE-2026-5006

A flaw was found in HashiCorp Vault. An authenticated attacker can manipulate identity values in templated policy paths by injecting slash characters. This manipulation allows Vault to misinterpret policy paths, leading to unintended access to Vault resources and potential privilege escalation...

intercept

!zreadhttps://img.shields.io/badge/AskZread-.svg?style=plastic&color=00b0aa&labelColor=000000&logo=data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIHZpZXdCb3g9IjAgMCAxNiAxNiIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZD0iTTQuOTYxNTYgMS42MDAxSDIuMjQxNTZD...

decker

Decker - Penetration Testing Orchestration Framework Purpose Decker is a penetration testing orchestration framework. It leverages HashiCorp Configuration Language 2 the same config language as Terraform to allow declarative penetration testing as code, so your tests can be versioned, shared,...

boundary

Boundary 什么是 Boundary：https://developer.hashicorp.com/boundary/docs/what-is-boundary 网站：https://www.developer.hashicorp.com/boundary/ 论坛：HashiCorp Discuss 文档：https://developer.hashicorp.com/boundary/docs 教程：HashiCorp 的 Learn 平台 Boundary 是一个身份感知代理，为访问网络上的主机和关键系统提供了一种简单、安全的方式。 借助 Boundary，你可以： 使用...

CVE-2026-14361

CVE-2026-14361 Consul Template 的 writeToFile 辅助函数直接打开操作者提供的目标路径，并跟随被链接的路径组件，从而使渲染输出能够逃逸预期目录并覆盖已存在的文件。 简介 我在审查 HashiCorp Consul Template 时发现了这个问题，当时脑海中有一个直接的文件系统安全问题： 如果writeToFile 收到的路径看似位于预期目录之内，它是否会验证文件系统实际将数据写入何处？ 在本例中，答案是否定的。 writeToFile 模板辅助函数通过 os.Create 或 os.OpenFile 直接打开用户提供的最终路径。...

grove

Grove は Software as a Service SaaS のログ収集フレームワークで、ログストリーミングにネイティブ対応していないサービスからのログ収集をサポートするように設計されています。 Grove により、チームはベンダーからセキュリティ関連のイベントを信頼性が高く一貫した方法で収集できます。このデータは、チームの既存のツールを使用して保存および分析し、脅威検知やコンプライアンスプログラムを支援できます。 Grove は標準で以下を提供します: 🪵 信頼性が高く定期的なログ収集 ☁️ 広く使われている多くの SaaS アプリケーションおよびサービスのサポート 🧱...

HashiCorp Consul/Consul Enterprise - Server-Side Request Forgery

HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11 are susceptible to server-side request forgery. When redirects are returned by HTTP health check endpoints, Consul follows these HTTP redirects by default. An attacker can possibly obtain sensitive information, modify data,...

Alibaba Sentinel - Server-side request forgery (SSRF)

There is a Pre-Auth SSRF vulnerability in Alibaba Sentinel version 1.8.2, which allows remote unauthenticated attackers to perform SSRF attacks via the /registry/machine endpoint through the ip parameter. id: CVE-2021-44139 info: name: Alibaba Sentinel - Server-side request forgery SSRF author:...

HashiCorp Consul/Consul Enterprise <=1.9.4 - Cross-Site Scripting

HashiCorp Consul and Consul Enterprise up to version 1.9.4 are vulnerable to cross-site scripting via the key-value KV raw mode. id: CVE-2020-25864 info: name: HashiCorp Consul/Consul Enterprise =1.9.4 - Cross-Site Scripting author: c-sh0 severity: medium description: | HashiCorp Consul and Consu...

CVE-2021-41805

CVE-2021-41805 - HashiCorp Consul Enterprise RCE !WARNING 法律免责声明： 此工具严格仅用于教育目的！ 在未事先获得双方同意的情况下使用此工具攻击目标是非法的。 使用此工具时，用户有责任遵守所有适用法律。 此工具的开发者不承担任何责任，也不对因使用本程序而导致的任何滥用或损害负责。 关于该 CVE 一个 ACL 令牌 （具有默认的 operator:write 权限）在一个命名空间中可用于在另一个命名空间中进行意外的权限提升。此漏洞可被滥用以获得提升权限的远程代码执行（RCE） 。 受影响版本 运行脚本： python3...

vault

Vault 注意 : 当社はVaultのセキュリティとユーザーの信頼を非常に重視しています。Vaultでセキュリティ上の問題を発見されたと思われる場合は、[email protected]までご連絡いただき、責任ある開示をお願いいたします。 ウェブサイト: developer.hashicorp.com/vault お知らせメーリングリスト: Google Groups ディスカッションフォーラム: Discuss ドキュメント: https://developer.hashicorp.com/vault/docs チュートリアル:...

CVE-2021-41805

CVE-2021-41805 HashiCorp Consul 通过 API 远程代码执行 HashiCorp Consul Enterprise 在 1.8.17 之前、1.9.x 在 1.9.11 之前以及 1.10.x 在 1.10.4 之前存在不正确的访问控制。一个命名空间中的 ACL 令牌（具有默认 operator:write 权限）可用于在另一个不同的命名空间中实现意外的权限提升。 摘要 CVEID : CVE-2021-41805 Base Score : 8.8 Severity : 高 Issued on : 2021-12-12 Affected Versions ...

CVE-2026-55102

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError, which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These...

My-Exploits

My-Exploits Vulnerability research I have done on four widely deployed platform services: Keycloak, Apache NiFi, HashiCorp Vault and HashiCorp Nomad. For each finding this repo carries the write-once artifacts I actually use, a Metasploit module where it made sense, a standalone Python proof of...

Security Bulletin: Consul vulnerable to an authorization bypass in the catalog deregistration path

Summary Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-imported catalog objects. A caller with service:write or node:write permission may exploit this issue to remove services, checks, or...

vault v2.1.0

Vault Please note : We take Vault's security and our users' trust very seriously. If you believe you have found a security issue in Vault, please responsibly disclose by contacting us at [email protected]. Website: developer.hashicorp.com/vault Announcement list: Google Groups Discussion...

CVE-2025-6000

CVE-2025-6000 — Esecuzione di Codice Privilegiata in HashiCorp Vault PoC Proof-of-concept per CVE-2025-6000 , una vulnerabilità di escalation dei privilegi fino a RCE nei backend di audit di HashiCorp Vault. Il dispositivo di audit consente a un chiamante privilegiato di controllare le opzioni...

Security Bulletin: Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths

Summary A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may...

CVE-2026-5006

A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include...

Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths

Summary A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may...