Hashicorp vulnerabilities
139 CVEs and advisories name Hashicorp as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-11374Consul's KV endpoint is vulnerable to denial of service
- CVE-2025-11375Consul's event endpoint is vulnerable to denial of service
- CVE-2025-12044Vault Vulnerable to Denial of Service Due to Rate Limit Regression
- CVE-2025-11621Vault AWS auth method bypass due to AWS client cache
- CVE-2025-6203Vault unauthenticated denial of service through complex json payload
- CVE-2025-8959HashiCorp go-getter Vulnerable to Arbitrary Read through Symlink Attack
- CVE-2025-6013Vault LDAP MFA Enforcement Bypass When Using Username As Alias
- CVE-2025-6015Vault Login MFA Bypass of Rate Limiting and TOTP Code Reuse
- CVE-2025-6011Timing Side-Channel in Vault’s Userpass Auth Method
- CVE-2025-6004Vault Userpass and LDAP User Lockout Bypass
- CVE-2025-6037Vault Certificate Auth Method Did Not Validate Common Name For Non-CA Certificates
- CVE-2025-6014Vault TOTP Secrets Engine Code Reuse
- CVE-2025-6000Arbitrary Remote Code Execution via Plugin Catalog Abuse
- CVE-2025-5999Vault Root Namespace Operator May Elevate Token Privileges
- CVE-2025-4656Vault Vulnerable to Recovery Key Cancellation Denial of Service
- CVE-2025-4922Nomad Vulnerable To Incorrect ACL Policy Lookup Attached To A Job
- CVE-2025-3744Nomad Vulnerable To Violation Of Mandatory Sentinel Policies in Nomad Job Submissions via Policy Override
- CVE-2025-3879Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login
- CVE-2025-4166Vault May Include Sensitive Data in Error Logs When Using the KV v2 Plugin
- CVE-2025-1296Nomad Exposes Sensitive Workload Identity and Client Secret Token in Audit Logs
- CVE-2025-1293HashiCorp Hermes Improperly Validates AWS ALB JWTs, which May Lead to Authentication Bypass
- CVE-2025-0937Nomad Vulnerable To Event Stream Namespace ACL Policy Bypass Through Wildcard Namespace
- CVE-2025-0377HashiCorp go-slug Vulnerable to Zip Slip Attack
- CVE-2024-12678Nomad Allocations Vulnerable To Privilege Escalation Within A Namespace Using Unredacted Workload Identity Tokens
- CVE-2024-12289Boundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service
- CVE-2024-10975Nomad Vulnerable To Cross-Namespace Volume Creation Abusing CSI Write Permission
- CVE-2024-8185Vault Vulnerable to Denial of Service When Processing Raft Join Requests
- CVE-2024-10086Consul Vulnerable To Reflected XSS On Content-Type Error Manipulation
- CVE-2024-10006Consul L7 Intentions Vulnerable To Headers Bypass
- CVE-2024-10005Consul L7 Intentions Vulnerable To URL Path Bypass