# CVE-2026-5051: Audit Log Plugin Directory Guard Bypass via Legacy path Option

> CVE-2026-5051: Audit Log Plugin Directory Guard Bypass via Legacy path Option. CVSS 4.4 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-5051
Last updated: 2026-07-02T17:54:27Z

- Published: 2026-07-01 17:10 UTC · Updated: 2026-07-02 17:54 UTC · Assigner: HashiCorp
- CVSS: 4.4 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
- EPSS: 0.38%, 32th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-22

## Description

HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used.  This vulnerability (CVE-2026-5051) is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17.

## Affected vendors and products

- HashiCorp: Vault
- HashiCorp: Vault Enterprise

## Tracked companies

- [HashiCorp](https://rewindex.com/company/hashicorp.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-5051)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-5051)
- [https://discuss.hashicorp.com/t/hcsec-2026-16-vault-audit-device-plugin-directory-guard-bypass-via-legacy-path-option/77536](https://discuss.hashicorp.com/t/hcsec-2026-16-vault-audit-device-plugin-directory-guard-bypass-via-legacy-path-option/77536)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-5051 · Markdown: https://rewindex.com/cve/CVE-2026-5051.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-5051 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:15:25.997Z