{"id":"CVE-2026-13303","title":"Boundary vulnerable to server-side request forgery in Vault credential store","summary":"HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential librarie…","severity":"high","cvss":8.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-918"],"vendor":"HashiCorp","product":"Boundary","affected":["Boundary >= 0.21.3 < *","boundary_enterprise >= 0.21.3 < 1.0.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-30T17:08:47.821598Z"},"published":"2026-10-29","updated":"2026-10-30","sourceUpdated":"2026-10-30T17:08:58.961Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-13303","references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-54-boundary-vulnerable-to-server-side-request-forgery-in-vault-credential-store/77932"}],"tags":["cve.org"],"epss":0.00222,"epssPercentile":0.12924,"ingestedAt":"2026-11-05T16:24:31.133Z","slug":"CVE-2026-13303","body":"## Overview\n\nHashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue outbound requests to a network destination of the requester's choosing and to receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service. This vulnerability, CVE-2026-13303, is fixed in Boundary Enterprise 1.0.2 and 0.21.6.\n\n## Affected\n\n- `Boundary >= 0.21.3 < *`\n- `boundary_enterprise >= 0.21.3 < 1.0.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":47.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}