Advisoriesby IbisVaultGHSA-72gw-fmmr-c4r4
HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization
No fix yet
If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/vault Go | >= 0.11.2, <= 1.21.4 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-201
- Also known as
- BIT-vault-2026-4525, CVE-2026-4525, GO-2026-5199
- nvd.nist.gov/vuln/detail/CVE-2026-4525
- access.redhat.com/security/cve/CVE-2026-4525
- bugzilla.redhat.com/show_bug.cgi?id=2459107
- discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344
- github.com/advisories/GHSA-72gw-fmmr-c4r4
- github.com/hashicorp/vault
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4525.json
More Vault advisories
All Vault
HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey OperationsCVE-2026-5807no fix yetHashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNSCVE-2026-5052no fix yetHashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-ServiceCVE-2026-3605no fix yetHashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSONCVE-2025-12044fixed in 1.21.0HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypassCVE-2025-11621fixed in 1.21.0HashiCorp Vault Community Edition Denial of Service Though Complex JSON PayloadsCVE-2025-6203fixed in 1.20.3