AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

HashiCorpCVE-2026-5051

HashiCorp Vault: path traversal

HashiCorp

CVE-2026-5051 · Published Jul 1, 2026 · updated Jul 2, 2026

Medium4.4
Fix: upgrade to 2.0.1 or later (2 fixed versions below)
HashiCorp advisory

HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used.

This vulnerability (CVE-2026-5051) is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17.

Affected versions

PackageAffectedFixed in
Vault
Product
>= 1.20.1, < 2.0.12.0.1
Vault Enterprise
Product
>= 1.19.0, < 2.0.12.0.1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-22

More HashiCorp advisories

All HashiCorp
Medium 4.2Jul 8HashiCorp Nomad: improper authorizationCVE-2026-14896fixed in 2.0.4 +1High 8.7Jul 8HashiCorp Nomad: link followingCVE-2026-14891fixed in 2.0.4 +1High 7.7Jul 8HashiCorp Nomad: missing authorizationCVE-2026-14373fixed in 2.0.4 +1Medium 4.7Jul 8HashiCorp Tooling: link followingCVE-2026-14361fixed in 0.42.1Medium 4.9Jul 8HashiCorp Shared library: denial of serviceCVE-2026-14362fixed in 0.6.0High 7.7Jul 6HashiCorp Terraform Enterprise: path traversalCVE-2026-14468fixed in 2.0.4