CLEANSTART-2026-BE61792 Security fixes in vault 1.21.4-r3

Package vault version 1.21.4-r3 fixes 2 vulnerabilities: CVE-2026-39883, CVE-2026-33816...

CLEANSTART-2026-XU98118 Security fixes in vault-csi-provider 1.7.0-r0

Package vault-csi-provider version 1.7.0-r0 fixes 20 vulnerabilities: CVE-2026-34986, CVE-2026-33186, CVE-2026-32280, CVE-2026-32281, CVE-2026-32283...

CLEANSTART-2026-FB10521 Security fixes in vault-fips 1.21.2-r1

Package vault-fips version 1.21.2-r1 fixes 4 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139, CVE-2026-33186...

CLEANSTART-2026-RH30892 Security fixes in vault 1.20.4-r1

Package vault version 1.20.4-r1 fixes 2 vulnerabilities: CVE-2026-34986, ghsa-78h2-9frx-2jm8...

CLEANSTART-2026-YF63935 Security fixes in vault 1.21.4-r0

Package vault version 1.21.4-r0 fixes 2 vulnerabilities: CVE-2026-33186, ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-JI06549 Security fixes in vault-k8s 1.7.4-r0

Package vault-k8s version 1.7.4-r0 fixes 31 vulnerabilities: CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-33811, CVE-2026-33814...

CLEANSTART-2026-BQ24500 Security fixes in vault 1.21.4-r8

Package vault version 1.21.4-r8 fixes 4 vulnerabilities: CVE-2026-46600, CVE-2026-56852, CVE-2026-39822, CVE-2026-42505...

CLEANSTART-2026-CM51888 Security fixes in vault 2.0.2-r0

Package vault version 2.0.2-r0 fixes 3 vulnerabilities: CVE-2026-56852, CVE-2026-46600, ghsa-hrxh-6v49-42gf...

CLEANSTART-2026-JN85199 Security fixes in vault 1.20.4-r2

Package vault version 1.20.4-r2 fixes 8 vulnerabilities: CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288...

CLEANSTART-2026-CC80125 Security fixes in vault 1.21.2-r1

Package vault version 1.21.2-r1 fixes 1 vulnerabilities: CVE-2026-33186...

CLEANSTART-2026-UR84573 Security fixes in vault 1.21.4-r5

Package vault version 1.21.4-r5 fixes 20 vulnerabilities: CVE-2026-39824, CVE-2026-39835, CVE-2026-46598, CVE-2026-25681, CVE-2026-27136...

SUSE CVE-2025-11621

Vault and Vault Enterprise's “Vault” AWS Auth method may be susceptible to authentication bypass if the role of the configured boundprincipaliam is the same across AWS accounts, or uses a wildcard. This vulnerability, CVE-2025-11621, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise...

SUSE CVE-2025-12044

Vault and Vault Enterprise “Vault” are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for +HCSEC-2025-24+|https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393...

BIT-OPENBAO-2026-39388 OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao's Certificate authentication method, when a token renewal is requested and disablebinding=true is set, attempts to verify the current request's presented mTLS certificate matches the original. Toke...

BIT-OPENBAO-2024-9180 Vault Operators in Root Namespace May Elevate Their Privileges

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16...

BIT-OPENBAO-2024-8185 Vault Vulnerable to Denial of Service When Processing Raft Join Requests

Vault Community and Vault Enterprise “Vault” clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service DoS attack through memory exhaustion through a Raft cluster join API endpoint . An attacker may send a large volume of requests to the endpoint which may cause Vaul...

BIT-OPENBAO-2024-7594 Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default

Vault’s SSH secrets engine did not require the validprincipals list to contain a value by default. If the validprincipals and defaultuser fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to...

CVE-2026-65708

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController...

CVE-2026-65710

sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...

EUVD-2026-48716

sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...