CVE-2026-12564

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...

CVE-2026-12564 Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...

CVE-2026-12564

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...

PT-2026-77167

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes auth function in awx plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential...

CVE-2026-12624

Vault’s ACL policy engine did not consistently enforce a wildcard glob deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was...

PT-2026-69874

Name of the Vulnerable Software and Affected Versions Vault Community Edition versions prior to 2.0.3 Vault Enterprise versions prior to 2.0.3 Vault Enterprise versions prior to 1.21.8 Vault Enterprise versions prior to 1.20.13 Vault Enterprise versions prior to 1.19.19 Description The ACL policy...

Malicious code in @servicetitan/contentful (npm)

npm/@servicetitan/contentful is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11951 Malicious code in @servicetitan/widget-platform-monolith (npm)

npm/@servicetitan/widget-platform-monolith is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were...

Malicious code in @servicetitan/hammer-token (npm)

npm/@servicetitan/hammer-token is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

BIT-OPENBAO-2026-39388 OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao's Certificate authentication method, when a token renewal is requested and disablebinding=true is set, attempts to verify the current request's presented mTLS certificate matches the original. Toke...

PT-2026-64267

A critical architectural breakdown targeting enterprise secret storage engines has been disclosed over the last 24 hours. A severe Zero-Day flaw dubbed "VaultSmuggle" tracked as CVE-2026-93401, CVSS 9.8 has been publicly revealed, heavily impacting HashiCorp Vault and OpenBao core clusters. When...

Important: Red Hat Security Advisory: external secrets operator for Red Hat OpenShift 1.0.1

external secrets operator for Red Hat OpenShift 1.0.1 The External Secrets Operator for Red Hat OpenShift builds on top of Kubernetes, which integrates external secret management systems like AWS Secrets Manager, HashiCorp Vault, Google Secrets Manager, Azure Key Vault, IBM Cloud Secrets Manager,...

CVE-2026-46590

Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata KeyMetadata through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsManagerKeyLifecycleManager read that metadat...

CVE-2026-46590

CVE-2026-46590 (Apache Camel-PQC) describes a deserialization of untrusted data issue in the camel-pqc component. Hashicorp Vault and AWS Secrets Manager key lifecycle managers deserialize a Base64-wrapped value via java.io.ObjectInputStream.readObject() without an ObjectInputFilter or class allo...

CVE-2026-5051

A flaw was found in HashiCorp Vault and Vault Enterprise. The audit device validation logic did not consistently apply plugin directory protections when a legacy file audit path option was used. This inconsistency could allow an attacker to bypass security controls, potentially leading to...

CVE-2026-5051

HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used. This vulnerability CVE-2026-5051 is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17...

GO-2026-5199 HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization in github.com/hashicorp/vault

HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization in github.com/hashicorp/vault...

GO-2026-5262 HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS in github.com/hashicorp/vault

HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS in github.com/hashicorp/vault...

GO-2026-5247 HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations in github.com/hashicorp/vault

HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations in github.com/hashicorp/vault...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...