Hashicorp vulnerabilities
139 CVEs and advisories name Hashicorp as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-19015Uncontrolled resource consumption in the Consul Connect CA roots endpoint
- CVE-2026-19014Uncontrolled resource consumption in the Consul Connect authorization endpoint
- CVE-2026-19012Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade path
- CVE-2026-19016Authorization bypass for session deletion in the transaction API
- CVE-2026-16326consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
- CVE-2026-16328consul-mcp-server vulnerable to server side request forgery leading to token exposure
- CVE-2026-16498terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
- CVE-2026-16496terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user
- CVE-2026-14869terraform-mcp-server vulnerable to server side request forgery leading to token exposure
- CVE-2026-14896Nomad vulnerable to cross-namespace host volume claim deletion
- CVE-2026-14361Consul-template is vulnerable to path redirection in writeToFile through symlink attack
- CVE-2026-14891Nomad vulnerable to sandbox escape in Docker task driver
- CVE-2026-14373Nomad Docker driver Linux host namespace bypass
- CVE-2026-14362Denial of service via crafted push/pull gossip message in memberlist
- CVE-2026-14468Path traversal allows arbitrary file read in Terraform Enterprise container
- CVE-2026-5051Audit Log Plugin Directory Guard Bypass via Legacy path Option
- CVE-2026-7474Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution
- CVE-2026-8052Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attack
- CVE-2026-6959Nomad vulnerable to arbitrary file read/write on client host through symlink attack
- CVE-2026-5061Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack
- CVE-2026-7776Boundary Workers Vulnerable to Denial of Service During TLS Handshake
- CVE-2026-5807Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations
- CVE-2026-4525Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header
- CVE-2026-5052Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS
- CVE-2026-3605Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service
- CVE-2026-4660Go-getter may allow to arbitrary filesystem reads through git operations
- CVE-2026-2808Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider
- CVE-2026-0969Arbitrary code execution in React server-side rendering of untrusted MDX content
- CVE-2025-13357Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method
- CVE-2025-13432Terraform Enterprise state versions can be created by users with specific permissions without sufficient write access