CompaniesHashiCorpMonthly reportsJuly 2026
HashiCorp in July 2026: incidents, uptime and changes
4incidents posted
2labelled major or critical
95.87%free of major/critical (partial)
95.00%free of any incident
0price changes
0notable page changes
Vendor-reported outage time 10 h 28 min, incident time 12 h 40 min. Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours. Last 90 days.
By vendor label: Major 2 · Minor 1 · No impact listed 1
Major and critical incidents 2
| Incident | Impact | Started | Duration | Status | Day |
|---|---|---|---|---|---|
| HCP Terraform Workspace Runs Failing with IAM Errors After AWS Provider Upgrade | Major | 8.1 h | resolved | 07-29 | |
| app.terraform.io is not loading | Major | 2.4 h | resolved | 07-30 |
Other incidents 2
| Incident | Impact | Started | Duration | Status | Day |
|---|---|---|---|---|---|
| Terraform Runs Failing to Fetch GitHub Sources Over SSH | Minor | 2.2 h | resolved | 07-21 | |
| Increased Load Times for HCP Portal | No impact listed | 16 h | resolved | 07-29 |
CVEs published
- CVE-2026-5051 Audit Log Plugin Directory Guard Bypass via Legacy path Option (CVSS 4.4)
- CVE-2026-14468 Path traversal allows arbitrary file read in Terraform Enterprise container (CVSS 7.7)
- CVE-2026-14362 Denial of service via crafted push/pull gossip message in memberlist (CVSS 4.9)
- CVE-2026-14373 Nomad Docker driver Linux host namespace bypass (CVSS 7.7)
- CVE-2026-14891 Nomad vulnerable to sandbox escape in Docker task driver (CVSS 8.7)
- CVE-2026-14361 Consul-template is vulnerable to path redirection in writeToFile through symlink attack (CVSS 4.7)
- CVE-2026-14896 Nomad vulnerable to cross-namespace host volume claim deletion (CVSS 4.2)
- CVE-2026-14869 terraform-mcp-server vulnerable to server side request forgery leading to token exposure (CVSS 8.6)
- CVE-2026-16496 terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user (CVSS 8.9)
- CVE-2026-16498 terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode (CVSS 10.0)
- CVE-2026-16328 consul-mcp-server vulnerable to server side request forgery leading to token exposure (CVSS 8.6)
- CVE-2026-16326 consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode (CVSS 10.0)
Maintenance 2
Cite this
HashiCorp posted 4 status incidents in July 2026 (2 major or critical); 0 price changes and 0 notable page changes observed.
- Title
- HashiCorp in July 2026
- Vendor
- HashiCorp
- Date
- URL
- https://rewindex.com/company/hashicorp/2026/07