---
id: CVE-2026-13303
title: Boundary vulnerable to server-side request forgery in Vault credential store
summary: >-
  HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side
  request forgery in the Vault credential store integration that may allow an
  authenticated user with permission to manage credential stores and credential
  librarie…
severity: high
cvss: 8.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: HashiCorp
product: Boundary
affected:
  - Boundary >= 0.21.3 < *
  - boundary_enterprise >= 0.21.3 < 1.0.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-30T17:08:47.821598Z'
published: '2026-10-29'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T17:08:58.961Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-13303'
references:
  - url: >-
      https://discuss.hashicorp.com/t/hcsec-2026-54-boundary-vulnerable-to-server-side-request-forgery-in-vault-credential-store/77932
tags:
  - cve.org
epss: 0.00222
epssPercentile: 0.12877
ingestedAt: '2026-11-05T16:24:31.133Z'
---

## Overview

HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue outbound requests to a network destination of the requester's choosing and to receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service. This vulnerability, CVE-2026-13303, is fixed in Boundary Enterprise 1.0.2 and 0.21.6.

## Affected

- `Boundary >= 0.21.3 < *`
- `boundary_enterprise >= 0.21.3 < 1.0.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.