# CVE-2026-4525: Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header

> CVE-2026-4525: Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header. CVSS 7.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-4525
Last updated: 2026-07-15T02:22:42Z

- Published: 2026-04-17 03:00 UTC · Updated: 2026-07-15 02:22 UTC · Assigner: HashiCorp
- CVSS: 7.5 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS: 0.41%, 35th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-201

## Description

If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

## Affected vendors and products

- HashiCorp: Vault
- HashiCorp: Vault Enterprise
- Red Hat: Red Hat OpenShift Container Platform 4
- Red Hat: Red Hat Openshift Data Foundation 4

## Tracked companies

- [HashiCorp](https://rewindex.com/company/hashicorp.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-4525)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-4525)
- [https://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344](https://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-4525 · Markdown: https://rewindex.com/cve/CVE-2026-4525.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-4525 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:09:55.362Z