# cve.now: Hashicorp

The newest entries naming Hashicorp as an affected vendor (up to 200), of 139 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-13303](https://cve.now/CVE-2026-13303.md): Boundary vulnerable to server-side request forgery in Vault credential store (CVSS 8.7)
- [CVE-2026-119168](https://cve.now/CVE-2026-119168.md): Nomad allocation data migration may allow host directory permission modification via symlink following (CVSS 8.8)
- [CVE-2026-107347](https://cve.now/CVE-2026-107347.md): Nomad dispatch payload writes can escape the allocation directory through symlinks (CVSS 8.4)
- [CVE-2026-102260](https://cve.now/CVE-2026-102260.md): Nomad vulnerable to cross-namespace information disclosure in multiple endpoints (CVSS 4.3)
- [CVE-2026-110720](https://cve.now/CVE-2026-110720.md): Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules (CVSS 9.9)
- [CVE-2026-115804](https://cve.now/CVE-2026-115804.md): Consul vulnerable to an authorization bypass in health check registration (CVSS 6.4)
- [CVE-2026-105626](https://cve.now/CVE-2026-105626.md): Consul vulnerable to a denial of service in HTTP APIs (CVSS 7.5)
- [CVE-2026-105608](https://cve.now/CVE-2026-105608.md): Consul vulnerable to an authorization bypass in service mesh registration (CVSS 8.8)
- [CVE-2026-105765](https://cve.now/CVE-2026-105765.md): Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API (CVSS 7.5)
- [CVE-2026-19585](https://cve.now/CVE-2026-19585.md): Go-getter vulnerable to a path traversal in S3/GCS directory download handling (CVSS 5.3)
- [CVE-2026-89322](https://cve.now/CVE-2026-89322.md): Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions (CVSS 7.2)
- [CVE-2026-105820](https://cve.now/CVE-2026-105820.md): Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution (CVSS 5.4)
- [CVE-2026-105816](https://cve.now/CVE-2026-105816.md): Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots (CVSS 8.0)
- [CVE-2026-105818](https://cve.now/CVE-2026-105818.md): Vault PKI ACME Issues Certificate With Unvalidated SANs (CVSS 5.9)
- [CVE-2026-88922](https://cve.now/CVE-2026-88922.md): Go-getter vulnerable to a privilege escalation issue in its archive decompression handling (CVSS 6.7)
- [CVE-2026-87993](https://cve.now/CVE-2026-87993.md): Consul-template vulnerable to an information disclosure issue in error handling (CVSS 7.7)
- [CVE-2026-88021](https://cve.now/CVE-2026-88021.md): Consul vulnerable to an authorization bypass in the Connect service mesh (CVSS 7.5)
- [CVE-2026-87107](https://cve.now/CVE-2026-87107.md): Consul vulnerable to an authorization bypass in the catalog deregistration path (CVSS 5.4)
- [CVE-2026-87106](https://cve.now/CVE-2026-87106.md): Consul vulnerable to a denial of service in the native RPC listener (CVSS 6.5)
- [CVE-2026-87090](https://cve.now/CVE-2026-87090.md): Consul vulnerable to an authorization bypass in the catalog node-write path (CVSS 8.3)
- [CVE-2026-5006](https://cve.now/CVE-2026-5006.md): Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths (CVSS 6.8)
- [CVE-2026-14978](https://cve.now/CVE-2026-14978.md): Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions (CVSS 5.5)
- [CVE-2026-19589](https://cve.now/CVE-2026-19589.md): Packer vulnerable to arbitrary file write via crafted plugin archive during installation (CVSS 7.1)
- [CVE-2026-8715](https://cve.now/CVE-2026-8715.md): Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath (CVSS 9.6)
- [CVE-2026-14886](https://cve.now/CVE-2026-14886.md): Vault Enterprise vulnerable to cross-namespace entity deletion (CVSS 8.2)
- [CVE-2026-12624](https://cve.now/CVE-2026-12624.md): Vault vulnerable to LIST authorization bypass via trailing-slash strip (CVSS 4.3)
- [CVE-2026-19113](https://cve.now/CVE-2026-19113.md): Unauthenticated denial of service via unbounded request body processing (CVSS 5.3)
- [CVE-2026-15972](https://cve.now/CVE-2026-15972.md): Unauthenticated denial of service via unbounded external gRPC connection acceptance (CVSS 7.5)
- [CVE-2026-15970](https://cve.now/CVE-2026-15970.md): L7 intention authorization bypass via custom public listener (CVSS 4.2)
- [CVE-2026-19017](https://cve.now/CVE-2026-19017.md): Consul vulnerable to partial arbitrary file read via Vault Connect CA provider (CVSS 6.8)
- [CVE-2026-19015](https://cve.now/CVE-2026-19015.md): Uncontrolled resource consumption in the Consul Connect CA roots endpoint (CVSS 5.3)
- [CVE-2026-19014](https://cve.now/CVE-2026-19014.md): Uncontrolled resource consumption in the Consul Connect authorization endpoint (CVSS 4.3)
- [CVE-2026-19012](https://cve.now/CVE-2026-19012.md): Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade path (CVSS 5.3)
- [CVE-2026-19016](https://cve.now/CVE-2026-19016.md): Authorization bypass for session deletion in the transaction API (CVSS 4.2)
- [CVE-2026-16326](https://cve.now/CVE-2026-16326.md): consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode (CVSS 10.0)
- [CVE-2026-16328](https://cve.now/CVE-2026-16328.md): consul-mcp-server vulnerable to server side request forgery leading to token exposure (CVSS 8.6)
- [CVE-2026-16498](https://cve.now/CVE-2026-16498.md): terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode (CVSS 10.0)
- [CVE-2026-16496](https://cve.now/CVE-2026-16496.md): terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user (CVSS 8.9)
- [CVE-2026-14869](https://cve.now/CVE-2026-14869.md): terraform-mcp-server vulnerable to server side request forgery leading to token exposure (CVSS 8.6)
- [CVE-2026-14896](https://cve.now/CVE-2026-14896.md): Nomad vulnerable to cross-namespace host volume claim deletion (CVSS 4.2)
- [CVE-2026-14361](https://cve.now/CVE-2026-14361.md): Consul-template is vulnerable to path redirection in writeToFile through symlink attack (CVSS 4.7)
- [CVE-2026-14891](https://cve.now/CVE-2026-14891.md): Nomad vulnerable to sandbox escape in Docker task driver (CVSS 8.7)
- [CVE-2026-14373](https://cve.now/CVE-2026-14373.md): Nomad Docker driver Linux host namespace bypass (CVSS 7.7)
- [CVE-2026-14362](https://cve.now/CVE-2026-14362.md): Denial of service via crafted push/pull gossip message in memberlist (CVSS 4.9)
- [CVE-2026-14468](https://cve.now/CVE-2026-14468.md): Path traversal allows arbitrary file read in Terraform Enterprise container (CVSS 7.7)
- [CVE-2026-5051](https://cve.now/CVE-2026-5051.md): Audit Log Plugin Directory Guard Bypass via Legacy path Option (CVSS 4.4)
- [CVE-2026-7474](https://cve.now/CVE-2026-7474.md): Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution (CVSS 8.8)
- [CVE-2026-8052](https://cve.now/CVE-2026-8052.md): Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attack (CVSS 6.0)
- [CVE-2026-6959](https://cve.now/CVE-2026-6959.md): Nomad vulnerable to arbitrary file read/write on client host through symlink attack (CVSS 6.0)
- [CVE-2026-5061](https://cve.now/CVE-2026-5061.md): Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack (CVSS 4.7)
- [CVE-2026-7776](https://cve.now/CVE-2026-7776.md): Boundary Workers Vulnerable to Denial of Service During TLS Handshake (CVSS 7.5)
- [CVE-2026-5807](https://cve.now/CVE-2026-5807.md): Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations (CVSS 7.5)
- [CVE-2026-4525](https://cve.now/CVE-2026-4525.md): Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header (CVSS 7.5)
- [CVE-2026-5052](https://cve.now/CVE-2026-5052.md): Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS (CVSS 5.3)
- [CVE-2026-3605](https://cve.now/CVE-2026-3605.md): Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service (CVSS 8.1)
- [CVE-2026-4660](https://cve.now/CVE-2026-4660.md): Go-getter may allow to arbitrary filesystem reads through git operations (CVSS 7.5)
- [CVE-2026-2808](https://cve.now/CVE-2026-2808.md): Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider (CVSS 6.8)
- [CVE-2026-0969](https://cve.now/CVE-2026-0969.md): Arbitrary code execution in React server-side rendering of untrusted MDX content (CVSS 8.8)
- [CVE-2025-13357](https://cve.now/CVE-2025-13357.md): Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method (CVSS 7.4)
- [CVE-2025-13432](https://cve.now/CVE-2025-13432.md): Terraform Enterprise state versions can be created by users with specific permissions without sufficient write access (CVSS 4.3)
- [CVE-2025-11374](https://cve.now/CVE-2025-11374.md): Consul's KV endpoint is vulnerable to denial of service (CVSS 6.5)
- [CVE-2025-11375](https://cve.now/CVE-2025-11375.md): Consul's event endpoint is vulnerable to denial of service (CVSS 6.5)
- [CVE-2025-12044](https://cve.now/CVE-2025-12044.md): Vault Vulnerable to Denial of Service Due to Rate Limit Regression (CVSS 7.5)
- [CVE-2025-11621](https://cve.now/CVE-2025-11621.md): Vault AWS auth method bypass due to AWS client cache (CVSS 8.1)
- [CVE-2025-6203](https://cve.now/CVE-2025-6203.md): Vault unauthenticated denial of service through complex json payload (CVSS 7.5)
- [CVE-2025-8959](https://cve.now/CVE-2025-8959.md): HashiCorp go-getter Vulnerable to Arbitrary Read through Symlink Attack (CVSS 7.5)
- [CVE-2025-6013](https://cve.now/CVE-2025-6013.md): Vault LDAP MFA Enforcement Bypass When Using Username As Alias (CVSS 6.5)
- [CVE-2025-6015](https://cve.now/CVE-2025-6015.md): Vault Login MFA Bypass of Rate Limiting and TOTP Code Reuse (CVSS 5.7)
- [CVE-2025-6011](https://cve.now/CVE-2025-6011.md): Timing Side-Channel in Vault’s Userpass Auth Method (CVSS 3.7)
- [CVE-2025-6004](https://cve.now/CVE-2025-6004.md): Vault Userpass and LDAP User Lockout Bypass (CVSS 5.3)
- [CVE-2025-6037](https://cve.now/CVE-2025-6037.md): Vault Certificate Auth Method Did Not Validate Common Name For Non-CA Certificates (CVSS 6.8)
- [CVE-2025-6014](https://cve.now/CVE-2025-6014.md): Vault TOTP Secrets Engine Code Reuse (CVSS 6.5)
- [CVE-2025-6000](https://cve.now/CVE-2025-6000.md): Arbitrary Remote Code Execution via Plugin Catalog Abuse (CVSS 9.1)
- [CVE-2025-5999](https://cve.now/CVE-2025-5999.md): Vault Root Namespace Operator May Elevate Token Privileges (CVSS 7.2)
- [CVE-2025-4656](https://cve.now/CVE-2025-4656.md): Vault Vulnerable to Recovery Key Cancellation Denial of Service (CVSS 3.1)
- [CVE-2025-4922](https://cve.now/CVE-2025-4922.md): Nomad Vulnerable To Incorrect ACL Policy Lookup Attached To A Job (CVSS 8.1)
- [CVE-2025-3744](https://cve.now/CVE-2025-3744.md): Nomad Vulnerable To Violation Of Mandatory Sentinel Policies in Nomad Job Submissions via Policy Override (CVSS 7.6)
- [CVE-2025-3879](https://cve.now/CVE-2025-3879.md): Vault’s Azure Authentication Method bound\_location Restriction Could be Bypassed on Login (CVSS 6.6)
- [CVE-2025-4166](https://cve.now/CVE-2025-4166.md): Vault May Include Sensitive Data in Error Logs When Using the KV v2 Plugin (CVSS 4.5)
- [CVE-2025-1296](https://cve.now/CVE-2025-1296.md): Nomad Exposes Sensitive Workload Identity and Client Secret Token in Audit Logs (CVSS 6.5)
- [CVE-2025-1293](https://cve.now/CVE-2025-1293.md): HashiCorp Hermes Improperly Validates AWS ALB JWTs, which May Lead to Authentication Bypass (CVSS 8.2)
- [CVE-2025-0937](https://cve.now/CVE-2025-0937.md): Nomad Vulnerable To Event Stream Namespace ACL Policy Bypass Through Wildcard Namespace (CVSS 7.1)
- [CVE-2025-0377](https://cve.now/CVE-2025-0377.md): HashiCorp go-slug Vulnerable to Zip Slip Attack (CVSS 7.5)
- [CVE-2024-12678](https://cve.now/CVE-2024-12678.md): Nomad Allocations Vulnerable To Privilege Escalation Within A Namespace Using Unredacted Workload Identity Tokens (CVSS 6.5)
- [CVE-2024-12289](https://cve.now/CVE-2024-12289.md): Boundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service (CVSS 5.9)
- [CVE-2024-10975](https://cve.now/CVE-2024-10975.md): Nomad Vulnerable To Cross-Namespace Volume Creation Abusing CSI Write Permission (CVSS 7.7)
- [CVE-2024-8185](https://cve.now/CVE-2024-8185.md): Vault Vulnerable to Denial of Service When Processing Raft Join Requests (CVSS 7.5)
- [CVE-2024-10086](https://cve.now/CVE-2024-10086.md): Consul Vulnerable To Reflected XSS On Content-Type Error Manipulation (CVSS 6.1)
- [CVE-2024-10006](https://cve.now/CVE-2024-10006.md): Consul L7 Intentions Vulnerable To Headers Bypass (CVSS 8.3)
- [CVE-2024-10005](https://cve.now/CVE-2024-10005.md): Consul L7 Intentions Vulnerable To URL Path Bypass (CVSS 8.1)
- [CVE-2024-10228](https://cve.now/CVE-2024-10228.md): Vagrant VMWare Utility installation files vulnerable to modification by unprivileged user (CVSS 3.8)
- [CVE-2024-9180](https://cve.now/CVE-2024-9180.md): Vault Operators in Root Namespace May Elevate Their Privileges (CVSS 7.2)
- [CVE-2024-7594](https://cve.now/CVE-2024-7594.md): Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default (CVSS 7.5)
- [CVE-2024-8365](https://cve.now/CVE-2024-8365.md): Vault Leaks AppRole Client Tokens And Accessor in Audit Log (CVSS 6.2)
- [CVE-2024-7625](https://cve.now/CVE-2024-7625.md): Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking (CVSS 5.8)
- [CVE-2024-6717](https://cve.now/CVE-2024-6717.md): Nomad Vulnerable to Allocation Directory Path Escape Through Archive Unpacking (CVSS 7.7)
- [CVE-2024-6468](https://cve.now/CVE-2024-6468.md): Vault Vulnerable to Denial of Service When Setting a Proxy Protocol Behavior (CVSS 7.5)
- [CVE-2024-6257](https://cve.now/CVE-2024-6257.md): HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation (CVSS 8.4)
- [CVE-2024-6104](https://cve.now/CVE-2024-6104.md): go-retryablehttp can leak basic auth credentials to log files (CVSS 6.0)
- [CVE-2024-5798](https://cve.now/CVE-2024-5798.md): Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims (CVSS 2.6)
- [CVE-2024-2877](https://cve.now/CVE-2024-2877.md): Vault Enterprise Leaks Sensitive HTTP Request Headers in the Audit Log When Deployed With a Performance Standby Node (CVSS 5.5)
- [CVE-2024-3817](https://cve.now/CVE-2024-3817.md): HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches (CVSS 9.8)
- [CVE-2024-2660](https://cve.now/CVE-2024-2660.md): Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses (CVSS 6.4)
- [CVE-2024-2048](https://cve.now/CVE-2024-2048.md): Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates (CVSS 8.1)
- [CVE-2024-1329](https://cve.now/CVE-2024-1329.md): Nomad Vulnerable to Arbitrary Write Through Symlink Attack (CVSS 7.7)
- [CVE-2024-1052](https://cve.now/CVE-2024-1052.md): Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering (CVSS 8.0)
- [CVE-2024-0831](https://cve.now/CVE-2024-0831.md): Vault May Expose Sensitive Information When Configuring An Audit Log Device (CVSS 4.5)
- [CVE-2023-6337](https://cve.now/CVE-2023-6337.md): Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests (CVSS 7.5)
- [CVE-2023-5954](https://cve.now/CVE-2023-5954.md): Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption (CVSS 5.9)
- [CVE-2023-5834](https://cve.now/CVE-2023-5834.md): Vagrant’s Windows Installer Allowed Directory Junction Write (CVSS 3.8)
- [CVE-2023-5077](https://cve.now/CVE-2023-5077.md): Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets (CVSS 7.6)
- [CVE-2023-3775](https://cve.now/CVE-2023-3775.md): Vault Enterprise's Sentinel RGP Policies Allowed For Cross-Namespace Denial of Service (CVSS 4.2)
- [CVE-2023-4680](https://cve.now/CVE-2023-4680.md): Vault's Transit Secrets Engine Allowed Nonce Specified without Convergent Encryption (CVSS 6.8)
- [CVE-2023-4782](https://cve.now/CVE-2023-4782.md): Terraform Allows Arbitrary File Write During Init Operation (CVSS 6.3)
- [CVE-2023-3518](https://cve.now/CVE-2023-3518.md): JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access (CVSS 7.4)
- [CVE-2023-3462](https://cve.now/CVE-2023-3462.md): Vault's LDAP Auth Method Allows for User Enumeration (CVSS 5.3)
- [CVE-2023-3774](https://cve.now/CVE-2023-3774.md): Vault Enterprise Namespace Creation May Lead to Denial of Service (CVSS 4.9)
- [CVE-2023-3300](https://cve.now/CVE-2023-3300.md): Nomad Search API Leaks Information About CSI Plugins (CVSS 5.3)
- [CVE-2023-3299](https://cve.now/CVE-2023-3299.md): Nomad Caller ACL Token's Secret ID is Exposed to Sentinel (CVSS 3.4)
- [CVE-2023-3072](https://cve.now/CVE-2023-3072.md): Nomad ACL Policies without Label are Applied to Unexpected Resources (CVSS 4.1)
- [CVE-2023-3114](https://cve.now/CVE-2023-3114.md): Terraform Enterprise Agent Pool Controls Allowed Unauthorized Workspaces To Target an Agent Pool (CVSS 5.0)
- [CVE-2023-2121](https://cve.now/CVE-2023-2121.md): Vault’s KV Diff Viewer Allowed for HTML Injection (CVSS 4.3)
- [CVE-2023-1297](https://cve.now/CVE-2023-1297.md): Consul Cluster Peering can Result in Denial of Service (CVSS 4.9)
- [CVE-2023-2816](https://cve.now/CVE-2023-2816.md): Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner (CVSS 8.7)
- [CVE-2023-2197](https://cve.now/CVE-2023-2197.md): Vault Enterprise Vulnerable to Padding Oracle Attacks When Using a CBC-based Encryption Mechanism with a HSM (CVSS 2.5)
- [CVE-2023-1782](https://cve.now/CVE-2023-1782.md): Nomad Unauthenticated Client Agent HTTP Request Privilege Escalation (CVSS 10.0)
- [CVE-2023-0620](https://cve.now/CVE-2023-0620.md): Vault Vulnerable to SQL Injection When Configuring the Microsoft SQL Database Storage Backend (CVSS 6.5)
- [CVE-2023-0665](https://cve.now/CVE-2023-0665.md): Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata (CVSS 6.5)
- [CVE-2023-25000](https://cve.now/CVE-2023-25000.md): Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations (CVSS 5.0)
- [CVE-2023-1299](https://cve.now/CVE-2023-1299.md): Nomad Job Submitter Privilege Escalation Using Workload Identity (CVSS 7.4)
- [CVE-2023-1296](https://cve.now/CVE-2023-1296.md): Nomad ACLs Can Not Deny Access to Workload's Own Variables (CVSS 2.7)
- [CVE-2023-24999](https://cve.now/CVE-2023-24999.md): Vault Fails to Verify if the AppRole SecretID Belongs to Role During a Destroy Operation (CVSS 4.4)
- [CVE-2023-0845](https://cve.now/CVE-2023-0845.md): Consul Server Panic when Ingress and API Gateways Configured with Peering (CVSS 4.9)
- [CVE-2023-0821](https://cve.now/CVE-2023-0821.md): Nomad Client Vulnerable to Decompression Bombs in Artifact Block (CVSS 6.5)
- [CVE-2023-0475](https://cve.now/CVE-2023-0475.md): Go-Getter Vulnerable to Decompression Bombs (CVSS 4.2)
- [CVE-2023-0690](https://cve.now/CVE-2023-0690.md): Boundary Workers Store Rotated Credentials in Plaintext Even When a Key Management Service Configured (CVSS 5.0)
- [CVE-2022-3920](https://cve.now/CVE-2022-3920.md): Consul Peering Imported Nodes/Services Leak (CVSS 5.3)
- [CVE-2022-3867](https://cve.now/CVE-2022-3867.md): Nomad Event Stream Subscriber Using a Token with TTL Receives Updates Until Garbage Collected (CVSS 2.7)
- [CVE-2022-3866](https://cve.now/CVE-2022-3866.md): Nomad Workload Identity Token Can List Non-sensitive Metadata for Paths Under nomad/ (CVSS 5.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/hashicorp
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.