HashiCorp CVEs
82 vulnerabilities mapped to HashiCorp’s software or packages, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-19585 Go-getter vulnerable to a path traversal in S3/GCS directory download handling
CVSS 5.3 mediumEPSS 0.21%
CVE-2026-89322 Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions
CVSS 7.2 highEPSS 0.30%
CVE-2026-105820 Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution
CVSS 5.4 mediumEPSS 0.25%
CVE-2026-105818 Vault PKI ACME Issues Certificate With Unvalidated SANs
CVSS 5.9 mediumEPSS 0.08%
CVE-2026-88922 Go-getter vulnerable to a privilege escalation issue in its archive decompression handling
CVSS 6.7 mediumEPSS 0.11%
CVE-2026-87993 Consul-template vulnerable to an information disclosure issue in error handling
CVSS 7.7 highEPSS 0.38%
CVE-2026-88021 Consul vulnerable to an authorization bypass in the Connect service mesh
CVSS 7.5 highEPSS 0.33%
CVE-2026-87107 Consul vulnerable to an authorization bypass in the catalog deregistration path
CVSS 5.4 mediumEPSS 0.31%
CVE-2026-87106 Consul vulnerable to a denial of service in the native RPC listener
CVSS 6.5 mediumEPSS 0.41%
CVE-2026-87090 Consul vulnerable to an authorization bypass in the catalog node-write path
CVSS 8.3 highEPSS 0.37%
CVE-2026-5006 Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths
CVSS 6.8 mediumEPSS 0.28%
CVE-2026-14886 Vault Enterprise vulnerable to cross-namespace entity deletion
CVSS 8.2 highEPSS 0.33%
CVE-2026-12624 Vault vulnerable to LIST authorization bypass via trailing-slash strip
CVSS 4.3 mediumEPSS 0.27%
CVE-2026-19113 Unauthenticated denial of service via unbounded request body processing
CVSS 5.3 mediumEPSS 0.40%
CVE-2026-15970 L7 intention authorization bypass via custom public listener
CVSS 4.2 mediumEPSS 0.21%
CVE-2026-19017 Consul vulnerable to partial arbitrary file read via Vault Connect CA provider
CVSS 6.8 mediumEPSS 0.46%
CVE-2026-19015 Uncontrolled resource consumption in the Consul Connect CA roots endpoint
CVSS 5.3 mediumEPSS 0.40%
CVE-2026-19014 Uncontrolled resource consumption in the Consul Connect authorization endpoint
CVSS 4.3 mediumEPSS 0.36%
CVE-2026-19012 Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade path
CVSS 5.3 mediumEPSS 0.33%
CVE-2026-19016 Authorization bypass for session deletion in the transaction API
CVSS 4.2 mediumEPSS 0.27%
CVE-2026-16326 consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
CVSS 10.0 criticalEPSS 0.54%
CVE-2026-16498 terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
CVSS 10.0 criticalEPSS 0.46%
CVE-2026-14896 Nomad vulnerable to cross-namespace host volume claim deletion
CVSS 4.2 mediumEPSS 0.25%
CVE-2026-14361 Consul-template is vulnerable to path redirection in writeToFile through symlink attack
CVSS 4.7 mediumEPSS 0.13%
CVE-2026-14891 Nomad vulnerable to sandbox escape in Docker task driver
CVSS 8.7 highEPSS 0.49%
CVE-2026-14373 Nomad Docker driver Linux host namespace bypass
CVSS 7.7 highEPSS 0.34%
CVE-2026-14362 Denial of service via crafted push/pull gossip message in memberlist
CVSS 4.9 mediumEPSS 0.25%
CVE-2026-14468 Path traversal allows arbitrary file read in Terraform Enterprise container
CVSS 7.7 highEPSS 0.44%
CVE-2026-5051 Audit Log Plugin Directory Guard Bypass via Legacy path Option
CVSS 4.4 mediumEPSS 0.38%
CVE-2026-6959 Nomad vulnerable to arbitrary file read/write on client host through symlink attack
CVSS 6.0 mediumEPSS 0.17%
CVE-2026-5061 Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack
CVSS 4.7 mediumEPSS 0.15%
CVE-2026-7776 Boundary Workers Vulnerable to Denial of Service During TLS Handshake
CVSS 7.5 highEPSS 0.20%
CVE-2026-4525 Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header
CVSS 7.5 highEPSS 0.41%
CVE-2026-3605 Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service
CVSS 8.1 highEPSS 0.38%
CVE-2026-4660 Go-getter may allow to arbitrary filesystem reads through git operations
CVSS 7.5 highEPSS 0.58%
CVE-2026-0969 Arbitrary code execution in React server-side rendering of untrusted MDX content
CVSS 8.8 highEPSS 0.65%
CVE-2025-13357 Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method
CVSS 7.4 highEPSS 0.53%
All vendors’ CVEs · JSON · Markdown
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)