HashiCorp has 44 CVEs on record between 2021 and 2026. Disclosure cadence is accelerating: 16 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 10. The median CVSS is 7.3 (high), with 1 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-863 (4) and CWE-22 (3). Most affected products: github.com/hashicorp/vault (15), Consul (8), github.com/hashicorp/consul (8).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.3
- Publish → KEV
- —
- Last 90 days
- 16 prev 0
Weakness classes
Products
- github.com/hashicorp/vault 15
- Consul 8
- github.com/hashicorp/consul 8
- Vault 4
- Shared library 2
- Tooling 2
Worst active — by depth score
CVE-2026-110720Critical· 9.9Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules55CVE-2026-105608High· 8.8Consul vulnerable to an authorization bypass in service mesh registration48CVE-2026-87090High· 8.3Consul vulnerable to an authorization bypass in the catalog node-write path46CVE-2026-105816High· 8.0Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory44CVE-2026-87993High· 7.7The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task event…42
HashiCorp vulnerabilities
CVEs affecting HashiCorp, newest first. Open any entry for full detail, references, and exploit status.
44 CVEsRSS
CVE-2024-6468High· 7.5Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions
Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions
CVE-2024-5798Low· 2.6HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims
HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims
CVE-2023-5954High· 7.5HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability
HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability
CVE-2023-5077High· 7.6Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability
Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability
CVE-2023-4680Medium· 6.8HashiCorp Vault Improper Input Validation vulnerability
HashiCorp Vault Improper Input Validation vulnerability
CVE-2023-3518High· 7.4Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT Providers
Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT Providers
CVE-2023-0845Medium· 6.5Consul Server Panic when Ingress and API Gateways Configured with Peering Connections
Consul Server Panic when Ingress and API Gateways Configured with Peering Connections
CVE-2022-3920High· 7.5Missing Authorization in HashiCorp Consul
Missing Authorization in HashiCorp Consul
CVE-2021-41803High· 7.1HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions
HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions
CVE-2020-8567Medium· 4.9Kubernetes Secrets Store CSI Driver plugins arbitrary file write
Kubernetes Secrets Store CSI Driver plugins arbitrary file write
CVE-2018-19653Medium· 5.9HashiCorp Consul can use cleartext agent-to-agent RPC communication
HashiCorp Consul can use cleartext agent-to-agent RPC communication
CVE-2021-38698Medium· 6.5HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access…
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic.
CVE-2021-32574High· 7.5Hashicorp Consul Missing SSL Certificate Validation
Hashicorp Consul Missing SSL Certificate Validation
CVE-2020-7219High· 7.5Denial of Service (DoS) in HashiCorp Consul
Denial of Service (DoS) in HashiCorp Consul