CVEs for HashiCorp
82 matching vulnerabilities, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-19585 Go-getter vulnerable to a path traversal in S3/GCS directory download handling
CVSS 5.3 mediumEPSS 0.21%HashiCorp
CVE-2026-89322 Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions
CVSS 7.2 highEPSS 0.30%HashiCorp
CVE-2026-105820 Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution
CVSS 5.4 mediumEPSS 0.25%HashiCorp
CVE-2026-105818 Vault PKI ACME Issues Certificate With Unvalidated SANs
CVSS 5.9 mediumEPSS 0.08%HashiCorp
CVE-2026-88021 Consul vulnerable to an authorization bypass in the Connect service mesh
CVSS 7.5 highEPSS 0.33%HashiCorp
CVE-2026-87107 Consul vulnerable to an authorization bypass in the catalog deregistration path
CVSS 5.4 mediumEPSS 0.31%HashiCorp
CVE-2026-87106 Consul vulnerable to a denial of service in the native RPC listener
CVSS 6.5 mediumEPSS 0.41%HashiCorp
CVE-2026-14886 Vault Enterprise vulnerable to cross-namespace entity deletion
CVSS 8.2 highEPSS 0.33%HashiCorp
CVE-2026-12624 Vault vulnerable to LIST authorization bypass via trailing-slash strip
CVSS 4.3 mediumEPSS 0.27%HashiCorp
CVE-2026-19113 Unauthenticated denial of service via unbounded request body processing
CVSS 5.3 mediumEPSS 0.40%HashiCorp
CVE-2026-15970 L7 intention authorization bypass via custom public listener
CVSS 4.2 mediumEPSS 0.21%HashiCorp
CVE-2026-19017 Consul vulnerable to partial arbitrary file read via Vault Connect CA provider
CVSS 6.8 mediumEPSS 0.46%HashiCorp
CVE-2026-19015 Uncontrolled resource consumption in the Consul Connect CA roots endpoint
CVSS 5.3 mediumEPSS 0.40%HashiCorp
CVE-2026-19014 Uncontrolled resource consumption in the Consul Connect authorization endpoint
CVSS 4.3 mediumEPSS 0.36%HashiCorp
CVE-2026-19016 Authorization bypass for session deletion in the transaction API
CVSS 4.2 mediumEPSS 0.27%HashiCorp
CVE-2026-14896 Nomad vulnerable to cross-namespace host volume claim deletion
CVSS 4.2 mediumEPSS 0.25%HashiCorp
CVE-2026-14891 Nomad vulnerable to sandbox escape in Docker task driver
CVSS 8.7 highEPSS 0.49%HashiCorp
CVE-2026-14373 Nomad Docker driver Linux host namespace bypass
CVSS 7.7 highEPSS 0.34%HashiCorp
CVE-2026-14362 Denial of service via crafted push/pull gossip message in memberlist
CVSS 4.9 mediumEPSS 0.25%HashiCorp
CVE-2026-5051 Audit Log Plugin Directory Guard Bypass via Legacy path Option
CVSS 4.4 mediumEPSS 0.38%HashiCorp
CVE-2026-7776 Boundary Workers Vulnerable to Denial of Service During TLS Handshake
CVSS 7.5 highEPSS 0.20%HashiCorp
CVE-2026-3605 Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service
CVSS 8.1 highEPSS 0.38%HashiCorp
CVE-2026-4660 Go-getter may allow to arbitrary filesystem reads through git operations
CVSS 7.5 highEPSS 0.58%HashiCorp
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)