AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

HashiCorpCVE-2026-19589

HashiCorp Packer: code execution

HashiCorp

CVE-2026-19589 · Published Aug 17, 2026 · updated Aug 28, 2026

High7.1
Fix: upgrade to 1.16.0 or later
HashiCorp advisory

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability (CVE-2026-19589) is fixed in Packer 1.16.0.

Affected versions

PackageAffectedFixed in
Packer
Product
>= 1.7.0, < 1.16.01.16.0
Details and references
CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-22

More HashiCorp advisories

All HashiCorp
Medium 6.8Aug 24HashiCorp Vault: insecure direct object referenceCVE-2026-5006fixed in 2.0.4 +1Critical 9.6Aug 13HashiCorp Tooling: arbitrary file readCVE-2026-8715fixed in 1.5.0High 8.2Aug 10HashiCorp Vault Enterprise: missing authorizationCVE-2026-14886fixed in 2.0.4Medium 4.3Aug 10HashiCorp Vault: improper authorizationCVE-2026-12624fixed in 2.0.3 +1High 7.5Aug 7HashiCorp Consul: denial of serviceCVE-2026-15972fixed in 2.0.3 +1Medium 5.3Aug 7HashiCorp Consul: denial of serviceCVE-2026-19012fixed in 2.0.3 +1