HashiCorp vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-110720 Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtaiCritical 9.9 · Oct 26, 2026
• CVE-2026-105765 HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may alHigh 7.5 · Oct 26, 2026
• CVE-2026-105626 HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a CHigh 7.5 · Oct 26, 2026
• CVE-2026-105608 HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration.High 8.8 · Oct 26, 2026
• CVE-2026-89322 Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names.High 7.2 · Oct 7, 2026
• CVE-2026-105816 Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory.High 8 · Oct 7, 2026
• CVE-2026-88021 Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not autHigh 7.1 · Sep 10, 2026
• CVE-2026-87993 The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in templateHigh 7.7 · Sep 10, 2026
• CVE-2026-87090 Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete anotherHigh 8.3 · Sep 10, 2026
• CVE-2026-19589 Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execHigh 7.1 · Aug 17, 2026
• CVE-2026-8715 Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration tCritical 9.6 · Aug 13, 2026
• CVE-2026-14886 Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one nHigh 8.2 · Aug 10, 2026
• CVE-2026-15972 Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptanHigh 7.5 · Aug 7, 2026
• CVE-2026-16328 In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the serveHigh 8.6 · Jul 29, 2026
• CVE-2026-16326 In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication toCritical 10 · Jul 29, 2026
• CVE-2026-16498 The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may alCritical 10 · Jul 28, 2026
• CVE-2026-16496 The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who High 8.9 · Jul 28, 2026
• CVE-2026-14869 The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthentiHigh 8.6 · Jul 28, 2026
• CVE-2026-14891 HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job submitter to bind-mount a host path into High 8.7 · Jul 8, 2026
• CVE-2026-14373 HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's host namespace mode options.High 7.7 · Jul 8, 2026
• CVE-2026-14468 HashiCorp Terraform Enterprise contained an issue in its version control system (VCS) ingestion of registry modules that did not correctly enforce the intended High 7.7 · Jul 6, 2026
• CVE-2026-7474 HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack.High 8.8 · May 12, 2026
• CVE-2026-7776 Boundary Community Edition and Boundary Enterprise (“Boundary”) workers are vulnerable to a denial-of-service condition during node enrollment TLS handshakes.High 7.5 · May 4, 2026
• CVE-2026-5807 Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operatioHigh 7.5 · Apr 17, 2026
• CVE-2026-4525 If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwardedHigh 7.5 · Apr 17, 2026