CVE-2026-105816

Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory configured, a privileged operator able to restore an Integrated Storage Raft...

CVE-2026-105816

Vault and Vault Enterprise are vulnerable to arbitrary code execution on the host because the software does not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. If Vault utilizes Shamir seals and an external plugin directory , a pri...

CVE-2026-105816 Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots

Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory configured, a privileged operator able to restore an Integrated Storage Raft...

CVE-2026-105816 Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots

Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory configured, a privileged operator able to restore an Integrated Storage Raft...

CVE-2026-105816 Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots

Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory configured, a privileged operator able to restore an Integrated Storage Raft...

Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots

Summary Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory configured, a privileged operator able to restore an Integrated Storage Ra...

@payloadcms/plugin-search (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105858 via @payloadcms/next (>=4.0.0-canary.0, <=4.0.0-canary.33)

@payloadcms/next NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105858 Source advisory: SNYK:JS-PAYLOADCMSNEXT-20571239...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105858 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105858 Source advisory: GHSA-97RH-RHH2-7VJV...

Payload has a tenant authorization bypass in Multi-Tenant Plugin

Impact When using the default tenant array field access, an authenticated user could assign themselves to other tenants. You are affected if: - You are using @payloadcms/plugin-multi-tenant If you configure the tenants arrayFieldAccess.create/update functions, a secured replacement membership...

Missing Authorization

Overview @payloadcms/plugin-multi-tenant is a Multi Tenant plugin for Payload Affected versions of this package are vulnerable to Missing Authorization via the tenant field write path in tenantField/index.ts, where tenant membership is not enforced on create or update operations. An authenticated...

EUVD-2026-93506

Payload has a tenant authorization bypass in Multi-Tenant Plugin...

@otherdev-software/canvas (1.0.0), payload-stack (>=0.2.0, <=0.3.0) potentially affected by CVE-2026-105860 via @payloadcms/plugin-multi-tenant (>=3.61.0, <=3.88.0)

@payloadcms/plugin-multi-tenant NPM version =3.61.0, =0.2.0, =0.3.0 Source cves: CVE-2026-105860 Source advisory: GHSA-P96C-XWX8-3CQJ...

@otherdev-software/canvas (1.0.0), payload-stack (>=0.2.0, <=0.3.0) potentially affected by CVE-2026-105860 via @payloadcms/plugin-multi-tenant (>=3.61.0, <=3.88.0)

@payloadcms/plugin-multi-tenant NPM version =3.61.0, =0.2.0, =0.3.0 Source cves: CVE-2026-105860 Source advisory: SNYK:JS-PAYLOADCMSPLUGINMULTITENANT-20936876...

GHSA-P96C-XWX8-3CQJ Payload has a tenant authorization bypass in Multi-Tenant Plugin

Impact When using the default tenant array field access, an authenticated user could assign themselves to other tenants. You are affected if: - You are using @payloadcms/plugin-multi-tenant If you configure the tenants arrayFieldAccess.create/update functions, a secured replacement membership...

@otherdev-software/canvas (1.0.0), payload-stack (>=0.2.0, <=0.3.0) potentially affected by CVE-2026-105860 via @payloadcms/plugin-multi-tenant (>=3.61.0, <=3.88.0)

@payloadcms/plugin-multi-tenant NPM version =3.61.0, =0.2.0, =0.3.0 Source cves: CVE-2026-105860 Source advisory: OSV:GHSA-P96C-XWX8-3CQJ...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105861 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105861 Source advisory: OSV:GHSA-PJ5H-5Q6C-3PFX...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105861 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105861 Source advisory: GHSA-PJ5H-5Q6C-3PFX...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105861 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105861 Source advisory: SNYK:JS-PAYLOAD-20570534...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105862 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105862 Source advisory: GHSA-2PWP-2369-8FG3...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105862 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105862 Source advisory: SNYK:JS-PAYLOAD-20570517...