CVE-2026-5807 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, vault, splunk-otel-collector-fips, vault-fips...

CVE-2026-5052 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, vault, splunk-otel-collector-fips, vault-fips...

CVE-2026-4525 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, vault, splunk-otel-collector-fips, vault-fips...

GHSA-8R5M-3F66-QPR3 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, vault, splunk-otel-collector-fips, vault-fips...

GHSA-72GW-FMMR-C4R4 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, vault, splunk-otel-collector-fips, vault-fips...

CVE-2026-5051

A flaw was found in HashiCorp Vault and Vault Enterprise. The audit device validation logic did not consistently apply plugin directory protections when a legacy file audit path option was used. This inconsistency could allow an attacker to bypass security controls, potentially leading to...

CVE-2026-5051

HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used. This vulnerability CVE-2026-5051 is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17...

CVE-2026-5051

HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used. This vulnerability CVE-2026-5051 is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17...

CVE-2026-5051 Audit Log Plugin Directory Guard Bypass via Legacy path Option

HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used. This vulnerability CVE-2026-5051 is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17...

EUVD-2026-41098

HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used. This vulnerability CVE-2026-5051 is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17...

CVE-2026-5051

CVE-2026-5051 affects HashiCorp Vault and Vault Enterprise prior to 2.0.1. The audit device plugin directory guard could be bypassed when using the legacy file audit path option, because the file audit backend accepted the legacy path as a fallback and did not validate the destination against the...

Vault Audit Device Plugin Directory Guard Bypass via Legacy Path Option

Summary HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used. This vulnerability CVE-2026-5051 is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17. Background Vault...

PT-2026-54782

Name of the Vulnerable Software and Affected Versions HashiCorp Vault versions prior to 2.0.1 HashiCorp Vault Enterprise versions prior to 2.0.1 Description Audit device validation logic fails to consistently apply plugin directory protections when the legacy file audit path option is utilized...

The vulnerability of the PKI Vault platform for archiving corporate information, including HashiCorp Vault Community Edition and Vault Enterprise, allows a perpetrator to disclose confidential information.

The vulnerability of the PKI Vault platform, which is used for archiving corporate information, in HashiCorp Vault Community Edition and Vault Enterprise, stems from insufficient validation of requests on the server side. Exploiting this vulnerability can allow a malicious actor to disclose...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: argo-events, kuma, flux-image-automation-controller, kubernetes, sops-fips, flux-operator, neuvector-sigstore-interface, crossplane-provider-azure-powerbidedicated, pulumi-language-yaml, gitlab-rails-ce-fips, crossplane-provider-azure-orbital, scorecard, gitlab-kas,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: argo-events, kuma, flux-image-automation-controller, kubernetes, sops-fips, flux-operator, neuvector-sigstore-interface, crossplane-provider-azure-powerbidedicated, pulumi-language-yaml, gitlab-rails-ce-fips, crossplane-provider-azure-orbital, scorecard, gitlab-kas,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: policy-controller, kaf, kargo, spire-server, docker-machine-driver-harvester, trivy-operator, age, vault-benchmark, kine, crossplane-provider-azure-sql, flux-kustomize-controller, argocd-image-updater, loki, crossplane-provider-azure-managedidentity, cilium, gitea,...

GO-2026-5487 HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service in github.com/hashicorp/vault

HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service in github.com/hashicorp/vault...

GO-2026-5199 HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization in github.com/hashicorp/vault

HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization in github.com/hashicorp/vault...

GO-2026-5247 HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations in github.com/hashicorp/vault

HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations in github.com/hashicorp/vault...