Sound the depths of every vulnerability.

▾ MidnightHashiCorp · ToolingEPSS 0.36%via CVEORG

Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules

Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed i…

CVE-2026-105765High· 7.5

▾ TwilightHashiCorp · ConsulEPSS 0.24%via CVEORG

Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API

HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf c…

CVE-2026-105608High· 8.8

▾ TwilightHashiCorp · ConsulEPSS 0.45%via CVEORG

Consul vulnerable to an authorization bypass in service mesh registration

HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh …

CVE-2026-105626High· 7.5

▾ TwilightHashiCorp · ConsulEPSS 0.43%via CVEORG

Consul vulnerable to a denial of service in HTTP APIs

HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Communit…

CVE-2026-115804Medium· 6.4

▾ SunlitHashiCorp · ConsulEPSS 0.29%via CVEORG

Consul vulnerable to an authorization bypass in health check registration

HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability …

CVE-2026-19585Medium· 5.3

▾ SunlitHashiCorp · Shared libraryEPSS 0.21%via NVD

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnera…

CVE-2026-89322High· 7.2

▾ TwilightHashiCorp · VaultEPSS 0.29%via NVD

Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names

Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and acc…

CVE-2026-105820Medium· 5.4

▾ SunlitHashiCorp · Vault EnterpriseEPSS 0.25%via NVD

Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs

Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, i…

CVE-2026-105818Medium· 5.9

▾ SunlitHashiCorp · VaultEPSS 0.08%via NVD

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate conta…

CVE-2026-105816High· 8.0

▾ TwilightHashiCorp · VaultEPSS 0.34%via NVD

Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory

Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory configured, a privileg…

CVE-2026-88922Medium· 6.7

▾ SunlitHashiCorp · Shared libraryEPSS 0.11%via NVD

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bit…

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bit…

CVE-2026-87993High· 7.7

▾ TwilightHashiCorp · ToolingEPSS 0.38%via NVD

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task event…

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task event…

CVE-2026-87090High· 8.3

▾ TwilightHashiCorp · ConsulEPSS 0.37%via CVEORG

Consul vulnerable to an authorization bypass in the catalog node-write path

Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node's catalog registration and take over its node identity. An attacker wit…

CVE-2026-87106Medium· 6.5

▾ SunlitHashiCorp · ConsulEPSS 0.41%via CVEORG

Consul vulnerable to a denial of service in the native RPC listener

Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory before ACL authorization is evaluated. A client that can complete the internal …

CVE-2026-88021High· 7.5

▾ TwilightHashiCorp · ConsulEPSS 0.34%via CVEORG

Consul vulnerable to an authorization bypass in the Connect service mesh

Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not authorized to access. When building Envoy RBAC rules to enforce Connect intentio…

CVE-2026-87107Medium· 5.4

▾ SunlitHashiCorp · ConsulEPSS 0.31%via CVEORG

Consul vulnerable to an authorization bypass in the catalog deregistration path

Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-imported catalog objects. A caller with {{service:write}} or {{node:write}} permiss…

CVE-2026-7776High· 7.5

▾ Twilighthashicorp · github.com/hashicorp/boundaryEPSS 0.20%via OSV

Hashicorp Boundary workers are vulnerable to a denial-of-service condition during node enrollment TLS handshakes

CVE-2026-5052Medium· 5.3

▾ Sunlithashicorp · github.com/hashicorp/vaultEPSS 0.34%via OSV

HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS

CVE-2026-5807High· 7.5

▾ Twilighthashicorp · github.com/hashicorp/vaultEPSS 0.72%via OSV

HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations

CVE-2026-4525High· 7.5