| Sep 15 | HashiCorp Shared library: privilege escalation Shared libraryMedium6.7Sep 15 | Shared library | Medium6.7 | 2.2.4 |
| Sep 10 | HashiCorp Tooling: information disclosureToolingHigh7.7Sep 10 | Tooling | High7.7 | 0.43.0 |
| Sep 10 | Consul and Consul Enterprise are vulnerable to an authorization bypass in the...ConsulHigh7.1Sep 10 | Consul | High7.1 | 2.0.4+1 more |
| Sep 10 | HashiCorp Consul: improper authorizationConsulHigh8.3Sep 10 | Consul | High8.3 | 2.0.4+1 more |
| Sep 10 | HashiCorp Consul: denial of serviceConsulMedium6.5Sep 10 | Consul | Medium6.5 | 2.0.4+1 more |
| Sep 10 | HashiCorp Consul: improper authorizationConsulMedium5.4Sep 10 | Consul | Medium5.4 | 2.0.4+1 more |
| Aug 24 | HashiCorp Vault: insecure direct object referenceHashiCorp VaultMedium6.8Aug 24 | HashiCorp Vault | Medium6.8 | 2.0.4+1 more |
| Aug 17 | HashiCorp Packer: code executionPackerHigh7.1Aug 17 | Packer | High7.1 | 1.16.0 |
| Aug 13 | HashiCorp Tooling: arbitrary file readToolingCritical9.6Aug 13 | Tooling | Critical9.6 | 1.5.0 |
| Aug 10 | HashiCorp Vault Enterprise: missing authorizationVault EnterpriseHigh8.2Aug 10 | Vault Enterprise | High8.2 | 2.0.4 |
| Aug 10 | HashiCorp Vault: improper authorizationVaultMedium4.3Aug 10 | Vault | Medium4.3 | 2.0.3+1 more |
| Aug 7 | HashiCorp Consul: denial of serviceConsulHigh7.5Aug 7 | Consul | High7.5 | 2.0.3+1 more |
| Aug 7 | HashiCorp Consul: denial of serviceConsulMedium5.3Aug 7 | Consul | Medium5.3 | 2.0.3+1 more |
| Aug 7 | HashiCorp Consul: resource exhaustionConsulMedium4.3Aug 7 | Consul | Medium4.3 | 2.0.3+1 more |
| Aug 7 | HashiCorp Consul: resource exhaustionConsulMedium5.3Aug 7 | Consul | Medium5.3 | 2.0.3+1 more |
| Aug 7 | HashiCorp Consul: path traversalConsulMedium4.2Aug 7 | Consul | Medium4.2 | 2.0.3+1 more |
| Aug 7 | HashiCorp Consul: arbitrary file readConsulMedium6.8Aug 7 | Consul | Medium6.8 | 2.0.3+1 more |
| Aug 7 | HashiCorp Consul: denial of serviceConsulMedium5.3Aug 7 | Consul | Medium5.3 | 2.0.3+1 more |
| Aug 7 | Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are...ConsulMedium4.2Aug 7 | Consul | Medium4.2 | 2.0.3+1 more |
| Jul 29 | HashiCorp Tooling: server-side request forgeryToolingHigh8.6Jul 29 | Tooling | High8.6 | 0.1.4 |
| Jul 29 | In consul-mcp-serverToolingCritical10.0Jul 29 | Tooling | Critical10.0 | 0.1.4 |
| Jul 28 | The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant...ToolingCritical10.0Jul 28 | Tooling | Critical10.0 | 1.1.0 |
| Jul 28 | HashiCorp Tooling: server-side request forgeryToolingHigh8.6Jul 28 | Tooling | High8.6 | 1.1.0 |
| Jul 28 | HashiCorp Tooling: session fixationToolingHigh8.9Jul 28 | Tooling | High8.9 | 1.1.0 |
| Jul 8 | HashiCorp Nomad: improper authorizationNomadMedium4.2Jul 8 | Nomad | Medium4.2 | 2.0.4+1 more |
| Jul 8 | HashiCorp Nomad: missing authorizationNomadHigh7.7Jul 8 | Nomad | High7.7 | 2.0.4+1 more |
| Jul 8 | HashiCorp Nomad: link followingNomadHigh8.7Jul 8 | Nomad | High8.7 | 2.0.4+1 more |
| Jul 8 | HashiCorp Tooling: link followingToolingMedium4.7Jul 8 | Tooling | Medium4.7 | 0.42.1 |
| Jul 8 | HashiCorp Shared library: denial of serviceShared libraryMedium4.9Jul 8 | Shared library | Medium4.9 | 0.6.0 |
| Jul 6 | HashiCorp Terraform Enterprise: path traversalTerraform EnterpriseHigh7.7Jul 6 | Terraform Enterprise | High7.7 | 2.0.4 |
| Jul 1 | HashiCorp Vault: path traversalVaultMedium4.4Jul 1 | Vault | Medium4.4 | 2.0.1+1 more |
| May 12 | HashiCorp Nomad vulnerable to symlink attack NomadMedium6.0May 12 | Nomad | Medium6.0 | 1.11.0-rc.1.0.20260512123500-2a09fd62c238 |
| May 12 | HashiCorp Nomad vulnerable to a path traversalNomadHigh8.8May 12 | Nomad | High8.8 | 1.11.0-rc.1.0.20260511152149-cd7240c4099a |
| May 5 | Boundary: denial of serviceBoundaryHigh7.5May 5 | Boundary | High7.5 | 0.19.5+2 more |
| Apr 17 | HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey OperationsVaultHigh7.5Apr 17 | Vault | High7.5 | No fix yet |
| Apr 17 | HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header SanitizationVaultHigh7.5Apr 17 | Vault | High7.5 | No fix yet |
| Apr 17 | HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNSVaultMedium5.3Apr 17 | Vault | Medium5.3 | No fix yet |
| Apr 17 | HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-ServiceVaultHigh8.1Apr 17 | Vault | High8.1 | No fix yet |
| Mar 12 | Consul is vulnerable to arbitrary file read when configured with Kubernetes authenticationConsulMedium6.8Mar 12 | Consul | Medium6.8 | 1.18.21+2 more |
| Oct 282025 | Consul key/value endpoint is vulnerable to denial of serviceConsulMedium6.5Oct 28, 2025 | Consul | Medium6.5 | 1.22.0 |
| Oct 282025 | Consul event endpoint is vulnerable to denial of serviceConsulMedium6.5Oct 28, 2025 | Consul | Medium6.5 | 1.22.0 |
| Oct 232025 | Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSONVaultHigh7.5Oct 23, 2025 | Vault | High7.5 | 1.21.0 |
| Oct 232025 | HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypassVaultHigh8.1Oct 23, 2025 | Vault | High8.1 | 1.21.0 |
| Aug 282025 | HashiCorp Vault Community Edition Denial of Service Though Complex JSON PayloadsVaultHigh7.5Aug 28, 2025 | Vault | High7.5 | 1.20.3 |
| Aug 62025 | HashiCorp Vault ldap auth method may not have correctly enforced MFAVaultMedium6.5Aug 6, 2025 | Vault | Medium6.5 | 1.20.2 |
| Aug 12025 | Hashicorp Vault has Incorrect Validation for Non-CA CertificatesVaultMedium6.8Aug 1, 2025 | Vault | Medium6.8 | 1.20.1 |
| Aug 12025 | Hashicorp Vault has Privilege Escalation VulnerabilityVaultHigh7.2Aug 1, 2025 | Vault | High7.2 | 1.20.0 |
| Aug 12025 | Hashicorp Vault has Code Execution Vulnerability via Plugin ConfigurationVaultCritical9.1Aug 1, 2025 | Vault | Critical9.1 | 1.20.1 |
| Aug 12025 | Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing UsersVaultLow3.7Aug 1, 2025 | Vault | Low3.7 | 1.20.1 |
| Aug 12025 | Hashicorp Vault has Lockout Feature Authentication BypassVaultMedium5.3Aug 1, 2025 | Vault | Medium5.3 | 1.20.1 |
| Aug 12025 | Hashicorp Vault's TOTP Secrets Engine Susceptible to Code ReuseVaultMedium6.5Aug 1, 2025 | Vault | Medium6.5 | 1.20.1 |
| Aug 12025 | Hashicorp Vault has Login MFA Rate Limit Bypass VulnerabilityVaultMedium5.7Aug 1, 2025 | Vault | Medium5.7 | 1.20.1 |
| Jun 262025 | Vault Community Edition rekey and recovery key operations can cause denial of serviceVaultLow3.1Jun 26, 2025 | Vault | Low3.1 | 1.20.0 |
| Jun 112025 | Hashicorp Nomad Incorrect Privilege Assignment vulnerabilityNomadHigh8.1Jun 11, 2025 | Nomad | High8.1 | 1.10.2 |
| May 22025 | Hashicorp Vault Community vulnerable to Incorrect AuthorizationVaultMedium6.6May 2, 2025 | Vault | Medium6.6 | 1.19.1 |
| May 22025 | Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive InformationVaultMedium4.5May 2, 2025 | Vault | Medium4.5 | 1.19.3 |
| Mar 102025 | Nomad: secrets in logsNomadMedium6.5Mar 10, 2025 | Nomad | Medium6.5 | No fix yet |
| Dec 202024 | Hashicorp Nomad Incorrect Privilege Assignment vulnerabilityNomadMedium6.5Dec 20, 2024 | Nomad | Medium6.5 | 1.9.4 |
| Dec 132024 | Boundary Community Edition and Boundary EnterpriseBoundaryMedium5.9Dec 13, 2024 | Boundary | Medium5.9 | 0.18.2 |
| Nov 72024 | Hashicorp Nomad Incorrect Authorization vulnerabilityNomadMedium7.7Nov 7, 2024 | Nomad | Medium7.7 | No fix yet |