CVE-2026-12564

CVE-2026-12564 is a critical (CVSS 9.6) SSRF vulnerability in the AAP Controller's HashiCorp Vault credential plugin . The kubernetes_auth() function in awx_plugins/credentials/hashivault.py sends the controller pod's Kubernetes service account token to an attacker-controlled URL when a Vault Sec...

PT-2026-77167

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes auth function in awx plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential...

BIT-VAULT-2026-12624 Vault vulnerable to LIST authorization bypass via trailing-slash strip

Vault’s ACL policy engine did not consistently enforce a wildcard glob deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was...

BIT-CONSUL-2026-19017 Consul vulnerable to partial arbitrary file read via Vault Connect CA provider

Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with operator:write permission may direct Consul to read and forward...

GO-2024-2982 vulnerabilities

Vulnerabilities for packages: vault...

GO-2024-3162 vulnerabilities

Vulnerabilities for packages: vault...

GO-2024-3113 vulnerabilities

Vulnerabilities for packages: vault...

GO-2024-3246 vulnerabilities

Vulnerabilities for packages: vault...

GO-2026-5262 vulnerabilities

Vulnerabilities for packages: vault-fips, vault, splunk-otel-collector-fips, splunk-otel-collector...

GO-2026-5487 vulnerabilities

Vulnerabilities for packages: vault-fips, vault, splunk-otel-collector-fips, splunk-otel-collector...

GO-2026-5199 vulnerabilities

Vulnerabilities for packages: vault-fips, vault, splunk-otel-collector-fips, splunk-otel-collector...

GO-2023-1793 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver, vault-csi-provider...

GO-2025-3848 vulnerabilities

Vulnerabilities for packages: vault, splunk-otel-collector-fips, splunk-otel-collector...

GO-2025-3924 vulnerabilities

Vulnerabilities for packages: vault, splunk-otel-collector-fips, splunk-otel-collector...

GO-2026-5247 vulnerabilities

Vulnerabilities for packages: vault-fips, vault, splunk-otel-collector-fips, splunk-otel-collector...

GO-2025-3413 vulnerabilities

Vulnerabilities for packages: opentofu-fips, vault, terraform, opentofu...

GO-2025-3650 vulnerabilities

Vulnerabilities for packages: grafana-alloy, sqlexporter, splunk-otel-collector-fips, splunk-otel-collector, grafana-alloy-fips, opentelemetry-collector-contrib, opentelemetry-collector-contrib-fips, vault, sqlexporter-fips...

GO-2025-3605 vulnerabilities

Vulnerabilities for packages: mattermost-fips, filebrowser, vault, kots...

GO-2024-2698 vulnerabilities

Vulnerabilities for packages: nuclei, mattermost-fips, gotenberg, wolfictl, kubescape, filebrowser, k9s, terragrunt, vault, kots, zarf, chainctl...

GO-2026-4923 vulnerabilities

Vulnerabilities for packages: elastic-agent-fips, loki, frankenphp-8.2, beats-fips, containerd, rke2-runtime-fips, zot, consul-fips, mattermost-fips, datadog-agent, commercial-grafana, beats, fuse-overlayfs-snapshotter, vault, datadog-agent-fips, rke2-runtime, cloudbeat, cloudbeat-fips,...