# HashiCorp CVEs > HashiCorp: 82 CVEs mapped to its software or packages (0 in CISA KEV), newest first, with CVSS and EPSS. Canonical: https://rewindex.com/company/hashicorp/cves Last updated: 2026-10-08T15:20:28Z 82 CVEs map to HashiCorp (0 in CISA KEV), newest first. Page 1. Query: `?sev=critical|high|medium|low&kev=yes|no&min_cvss=0..10&q=&page=N`. Company profile: [HashiCorp](https://rewindex.com/company/hashicorp.md) Scope: CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. A mapped CVE is not a statement that HashiCorp’s hosted service was exposed. | Published (UTC) | CVE | Title | CVSS | KEV | | --- | --- | --- | --- | --- | | 2026-10-08 | [CVE-2026-19585](https://rewindex.com/cve/CVE-2026-19585.md) | Go-getter vulnerable to a path traversal in S3/GCS directory download handling | 5.3 medium | | | 2026-10-07 | [CVE-2026-89322](https://rewindex.com/cve/CVE-2026-89322.md) | Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions | 7.2 high | | | 2026-10-07 | [CVE-2026-105820](https://rewindex.com/cve/CVE-2026-105820.md) | Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution | 5.4 medium | | | 2026-10-07 | [CVE-2026-105816](https://rewindex.com/cve/CVE-2026-105816.md) | Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots | 8.0 high | | | 2026-10-07 | [CVE-2026-105818](https://rewindex.com/cve/CVE-2026-105818.md) | Vault PKI ACME Issues Certificate With Unvalidated SANs | 5.9 medium | | | 2026-09-15 | [CVE-2026-88922](https://rewindex.com/cve/CVE-2026-88922.md) | Go-getter vulnerable to a privilege escalation issue in its archive decompression handling | 6.7 medium | | | 2026-09-10 | [CVE-2026-87993](https://rewindex.com/cve/CVE-2026-87993.md) | Consul-template vulnerable to an information disclosure issue in error handling | 7.7 high | | | 2026-09-10 | [CVE-2026-88021](https://rewindex.com/cve/CVE-2026-88021.md) | Consul vulnerable to an authorization bypass in the Connect service mesh | 7.5 high | | | 2026-09-10 | [CVE-2026-87107](https://rewindex.com/cve/CVE-2026-87107.md) | Consul vulnerable to an authorization bypass in the catalog deregistration path | 5.4 medium | | | 2026-09-10 | [CVE-2026-87106](https://rewindex.com/cve/CVE-2026-87106.md) | Consul vulnerable to a denial of service in the native RPC listener | 6.5 medium | | | 2026-09-10 | [CVE-2026-87090](https://rewindex.com/cve/CVE-2026-87090.md) | Consul vulnerable to an authorization bypass in the catalog node-write path | 8.3 high | | | 2026-08-24 | [CVE-2026-5006](https://rewindex.com/cve/CVE-2026-5006.md) | Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths | 6.8 medium | | | 2026-08-19 | [CVE-2026-14978](https://rewindex.com/cve/CVE-2026-14978.md) | Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions | 5.5 medium | | | 2026-08-17 | [CVE-2026-19589](https://rewindex.com/cve/CVE-2026-19589.md) | Packer vulnerable to arbitrary file write via crafted plugin archive during installation | 7.1 high | | | 2026-08-13 | [CVE-2026-8715](https://rewindex.com/cve/CVE-2026-8715.md) | Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath | 9.6 critical | | | 2026-08-10 | [CVE-2026-14886](https://rewindex.com/cve/CVE-2026-14886.md) | Vault Enterprise vulnerable to cross-namespace entity deletion | 8.2 high | | | 2026-08-10 | [CVE-2026-12624](https://rewindex.com/cve/CVE-2026-12624.md) | Vault vulnerable to LIST authorization bypass via trailing-slash strip | 4.3 medium | | | 2026-08-07 | [CVE-2026-19113](https://rewindex.com/cve/CVE-2026-19113.md) | Unauthenticated denial of service via unbounded request body processing | 5.3 medium | | | 2026-08-07 | [CVE-2026-15972](https://rewindex.com/cve/CVE-2026-15972.md) | Unauthenticated denial of service via unbounded external gRPC connection acceptance | 7.5 high | | | 2026-08-07 | [CVE-2026-15970](https://rewindex.com/cve/CVE-2026-15970.md) | L7 intention authorization bypass via custom public listener | 4.2 medium | | | 2026-08-07 | [CVE-2026-19017](https://rewindex.com/cve/CVE-2026-19017.md) | Consul vulnerable to partial arbitrary file read via Vault Connect CA provider | 6.8 medium | | | 2026-08-07 | [CVE-2026-19015](https://rewindex.com/cve/CVE-2026-19015.md) | Uncontrolled resource consumption in the Consul Connect CA roots endpoint | 5.3 medium | | | 2026-08-07 | [CVE-2026-19014](https://rewindex.com/cve/CVE-2026-19014.md) | Uncontrolled resource consumption in the Consul Connect authorization endpoint | 4.3 medium | | | 2026-08-07 | [CVE-2026-19012](https://rewindex.com/cve/CVE-2026-19012.md) | Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade path | 5.3 medium | | | 2026-08-07 | [CVE-2026-19016](https://rewindex.com/cve/CVE-2026-19016.md) | Authorization bypass for session deletion in the transaction API | 4.2 medium | | | 2026-07-29 | [CVE-2026-16326](https://rewindex.com/cve/CVE-2026-16326.md) | consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode | 10.0 critical | | | 2026-07-29 | [CVE-2026-16328](https://rewindex.com/cve/CVE-2026-16328.md) | consul-mcp-server vulnerable to server side request forgery leading to token exposure | 8.6 high | | | 2026-07-28 | [CVE-2026-16498](https://rewindex.com/cve/CVE-2026-16498.md) | terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode | 10.0 critical | | | 2026-07-28 | [CVE-2026-16496](https://rewindex.com/cve/CVE-2026-16496.md) | terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user | 8.9 high | | | 2026-07-28 | [CVE-2026-14869](https://rewindex.com/cve/CVE-2026-14869.md) | terraform-mcp-server vulnerable to server side request forgery leading to token exposure | 8.6 high | | | 2026-07-08 | [CVE-2026-14896](https://rewindex.com/cve/CVE-2026-14896.md) | Nomad vulnerable to cross-namespace host volume claim deletion | 4.2 medium | | | 2026-07-08 | [CVE-2026-14361](https://rewindex.com/cve/CVE-2026-14361.md) | Consul-template is vulnerable to path redirection in writeToFile through symlink attack | 4.7 medium | | | 2026-07-08 | [CVE-2026-14891](https://rewindex.com/cve/CVE-2026-14891.md) | Nomad vulnerable to sandbox escape in Docker task driver | 8.7 high | | | 2026-07-08 | [CVE-2026-14373](https://rewindex.com/cve/CVE-2026-14373.md) | Nomad Docker driver Linux host namespace bypass | 7.7 high | | | 2026-07-08 | [CVE-2026-14362](https://rewindex.com/cve/CVE-2026-14362.md) | Denial of service via crafted push/pull gossip message in memberlist | 4.9 medium | | | 2026-07-06 | [CVE-2026-14468](https://rewindex.com/cve/CVE-2026-14468.md) | Path traversal allows arbitrary file read in Terraform Enterprise container | 7.7 high | | | 2026-07-01 | [CVE-2026-5051](https://rewindex.com/cve/CVE-2026-5051.md) | Audit Log Plugin Directory Guard Bypass via Legacy path Option | 4.4 medium | | | 2026-05-12 | [CVE-2026-7474](https://rewindex.com/cve/CVE-2026-7474.md) | Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution | 8.8 high | | | 2026-05-12 | [CVE-2026-8052](https://rewindex.com/cve/CVE-2026-8052.md) | Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attack | 6.0 medium | | | 2026-05-12 | [CVE-2026-6959](https://rewindex.com/cve/CVE-2026-6959.md) | Nomad vulnerable to arbitrary file read/write on client host through symlink attack | 6.0 medium | | | 2026-05-12 | [CVE-2026-5061](https://rewindex.com/cve/CVE-2026-5061.md) | Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack | 4.7 medium | | | 2026-05-04 | [CVE-2026-7776](https://rewindex.com/cve/CVE-2026-7776.md) | Boundary Workers Vulnerable to Denial of Service During TLS Handshake | 7.5 high | | | 2026-04-17 | [CVE-2026-5807](https://rewindex.com/cve/CVE-2026-5807.md) | Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations | 7.5 high | | | 2026-04-17 | [CVE-2026-4525](https://rewindex.com/cve/CVE-2026-4525.md) | Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header | 7.5 high | | | 2026-04-17 | [CVE-2026-5052](https://rewindex.com/cve/CVE-2026-5052.md) | Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS | 5.3 medium | | | 2026-04-17 | [CVE-2026-3605](https://rewindex.com/cve/CVE-2026-3605.md) | Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service | 8.1 high | | | 2026-04-09 | [CVE-2026-4660](https://rewindex.com/cve/CVE-2026-4660.md) | Go-getter may allow to arbitrary filesystem reads through git operations | 7.5 high | | | 2026-03-11 | [CVE-2026-2808](https://rewindex.com/cve/CVE-2026-2808.md) | Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider | 6.8 medium | | | 2026-02-12 | [CVE-2026-0969](https://rewindex.com/cve/CVE-2026-0969.md) | Arbitrary code execution in React server-side rendering of untrusted MDX content | 8.8 high | | | 2025-11-21 | [CVE-2025-13357](https://rewindex.com/cve/CVE-2025-13357.md) | Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method | 7.4 high | | Next page: [page 2](https://rewindex.com/company/hashicorp/cves.md?page=2) --- _Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_ ## Charts ### Chart data: CVEs per week, last 52 weeks (HashiCorp) Weeks start Monday, UTC. Bars: CVEs by published date (KEV date added if unpublished), by CVSS severity; kev_added: entries added to CISA KEV that week. Same filters as the list. The current week is partial. | Week of (UTC) | Critical | High | Medium | Low | Not scored | Added to KEV | | --- | --- | --- | --- | --- | --- | --- | | 2025-11-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-10 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-17 | 0 | 1 | 1 | 0 | 0 | 0 | | 2025-11-24 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-29 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-12 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-26 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-09 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-02-16 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-23 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-09 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-03-16 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-23 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-30 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-06 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-04-13 | 0 | 3 | 1 | 0 | 0 | 0 | | 2026-04-20 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-04 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-05-11 | 0 | 1 | 3 | 0 | 0 | 0 | | 2026-05-18 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-25 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-29 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-07-06 | 0 | 3 | 3 | 0 | 0 | 0 | | 2026-07-13 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-20 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-27 | 2 | 3 | 0 | 0 | 0 | 0 | | 2026-08-03 | 0 | 1 | 7 | 0 | 0 | 0 | | 2026-08-10 | 1 | 1 | 1 | 0 | 0 | 0 | | 2026-08-17 | 0 | 1 | 1 | 0 | 0 | 0 | | 2026-08-24 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-08-31 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-07 | 0 | 3 | 2 | 0 | 0 | 0 | | 2026-09-14 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-09-21 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-28 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-05 | 0 | 2 | 3 | 0 | 0 | 0 | | 2026-10-12 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-26 | 0 | 0 | 0 | 0 | 0 | 0 | --- Canonical: https://rewindex.com/company/hashicorp/cves · Markdown: https://rewindex.com/company/hashicorp/cves.md · JSON: https://rewindex.com/api/v1/companies/hashicorp/cves · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T04:06:10.604Z