AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Companies

HashiCorp security advisories

162 advisories across Terraform, Vault, Consul, Vagrant, Nomad, Boundary, HashiCorp

Company profile
Critical 9.9Oct 26HashiCorp Tooling: improper authorizationToolingCVE-2026-110720fixed in 2.0.4High 7.5Oct 26HashiCorp Consul: missing authorizationConsulCVE-2026-105765fixed in 2.1.0 +1Medium 6.7Sep 15HashiCorp Shared library: privilege escalationShared libraryCVE-2026-88922fixed in 2.2.4High 7.7Sep 10HashiCorp Tooling: information disclosureToolingCVE-2026-87993fixed in 0.43.0High 7.1Sep 10Consul and Consul Enterprise are vulnerable to an authorization bypass in the...ConsulCVE-2026-88021fixed in 2.0.4 +1High 8.3Sep 10HashiCorp Consul: improper authorizationConsulCVE-2026-87090fixed in 2.0.4 +1Medium 6.5Sep 10HashiCorp Consul: denial of serviceConsulCVE-2026-87106fixed in 2.0.4 +1Medium 5.4Sep 10HashiCorp Consul: improper authorizationConsulCVE-2026-87107fixed in 2.0.4 +1Medium 6.8Aug 24HashiCorp Vault: insecure direct object referenceHashiCorp VaultCVE-2026-5006fixed in 2.0.4 +1High 7.1Aug 17HashiCorp Packer: code executionPackerCVE-2026-19589fixed in 1.16.0Critical 9.6Aug 13HashiCorp Tooling: arbitrary file readToolingCVE-2026-8715fixed in 1.5.0High 8.2Aug 10HashiCorp Vault Enterprise: missing authorizationVault EnterpriseCVE-2026-14886fixed in 2.0.4Medium 4.3Aug 10HashiCorp Vault: improper authorizationVaultCVE-2026-12624fixed in 2.0.3 +1High 7.5Aug 7HashiCorp Consul: denial of serviceConsulCVE-2026-15972fixed in 2.0.3 +1Medium 5.3Aug 7HashiCorp Consul: denial of serviceConsulCVE-2026-19012fixed in 2.0.3 +1Medium 4.3Aug 7HashiCorp Consul: resource exhaustionConsulCVE-2026-19014fixed in 2.0.3 +1Medium 5.3Aug 7HashiCorp Consul: resource exhaustionConsulCVE-2026-19015fixed in 2.0.3 +1Medium 4.2Aug 7HashiCorp Consul: path traversalConsulCVE-2026-19016fixed in 2.0.3 +1Medium 6.8Aug 7HashiCorp Consul: arbitrary file readConsulCVE-2026-19017fixed in 2.0.3 +1Medium 5.3Aug 7HashiCorp Consul: denial of serviceConsulCVE-2026-19113fixed in 2.0.3 +1Medium 4.2Aug 7Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are...ConsulCVE-2026-15970fixed in 2.0.3 +1High 8.6Jul 29HashiCorp Tooling: server-side request forgeryToolingCVE-2026-16328fixed in 0.1.4Critical 10.0Jul 29In consul-mcp-serverToolingCVE-2026-16326fixed in 0.1.4Critical 10.0Jul 28The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant...ToolingCVE-2026-16498fixed in 1.1.0High 8.6Jul 28HashiCorp Tooling: server-side request forgeryToolingCVE-2026-14869fixed in 1.1.0High 8.9Jul 28HashiCorp Tooling: session fixationToolingCVE-2026-16496fixed in 1.1.0Medium 4.2Jul 8HashiCorp Nomad: improper authorizationNomadCVE-2026-14896fixed in 2.0.4 +1High 7.7Jul 8HashiCorp Nomad: missing authorizationNomadCVE-2026-14373fixed in 2.0.4 +1High 8.7Jul 8HashiCorp Nomad: link followingNomadCVE-2026-14891fixed in 2.0.4 +1Medium 4.7Jul 8HashiCorp Tooling: link followingToolingCVE-2026-14361fixed in 0.42.1Medium 4.9Jul 8HashiCorp Shared library: denial of serviceShared libraryCVE-2026-14362fixed in 0.6.0High 7.7Jul 6HashiCorp Terraform Enterprise: path traversalTerraform EnterpriseCVE-2026-14468fixed in 2.0.4Medium 4.4Jul 1HashiCorp Vault: path traversalVaultCVE-2026-5051fixed in 2.0.1 +1Medium 6.0May 12HashiCorp Nomad vulnerable to symlink attackNomadCVE-2026-6959fixed in 1.11.0-rc.1.0.20260512123500-2a09fd62c238High 8.8May 12HashiCorp Nomad vulnerable to a path traversalNomadCVE-2026-7474fixed in 1.11.0-rc.1.0.20260511152149-cd7240c4099aHigh 7.5May 5Boundary: denial of serviceBoundaryCVE-2026-7776fixed in 0.19.5 +2High 7.5Apr 17HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey OperationsVaultCVE-2026-5807no fix yetHigh 7.5Apr 17HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header SanitizationVaultCVE-2026-4525no fix yetMedium 5.3Apr 17HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNSVaultCVE-2026-5052no fix yetHigh 8.1Apr 17HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-ServiceVaultCVE-2026-3605no fix yetMedium 6.8Mar 12Consul is vulnerable to arbitrary file read when configured with Kubernetes authenticationConsulCVE-2026-2808fixed in 1.18.21 +2Medium 6.5Oct 28, 2025Consul key/value endpoint is vulnerable to denial of serviceConsulCVE-2025-11374fixed in 1.22.0Medium 6.5Oct 28, 2025Consul event endpoint is vulnerable to denial of serviceConsulCVE-2025-11375fixed in 1.22.0High 7.5Oct 23, 2025Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSONVaultCVE-2025-12044fixed in 1.21.0High 8.1Oct 23, 2025HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypassVaultCVE-2025-11621fixed in 1.21.0High 7.5Aug 28, 2025HashiCorp Vault Community Edition Denial of Service Though Complex JSON PayloadsVaultCVE-2025-6203fixed in 1.20.3Medium 6.5Aug 6, 2025HashiCorp Vault ldap auth method may not have correctly enforced MFAVaultCVE-2025-6013fixed in 1.20.2Medium 6.8Aug 1, 2025Hashicorp Vault has Incorrect Validation for Non-CA CertificatesVaultCVE-2025-6037fixed in 1.20.1High 7.2Aug 1, 2025Hashicorp Vault has Privilege Escalation VulnerabilityVaultCVE-2025-5999fixed in 1.20.0Critical 9.1Aug 1, 2025Hashicorp Vault has Code Execution Vulnerability via Plugin ConfigurationVaultCVE-2025-6000fixed in 1.20.1Low 3.7Aug 1, 2025Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing UsersVaultCVE-2025-6011fixed in 1.20.1Medium 5.3Aug 1, 2025Hashicorp Vault has Lockout Feature Authentication BypassVaultCVE-2025-6004fixed in 1.20.1Medium 6.5Aug 1, 2025Hashicorp Vault's TOTP Secrets Engine Susceptible to Code ReuseVaultCVE-2025-6014fixed in 1.20.1Medium 5.7Aug 1, 2025Hashicorp Vault has Login MFA Rate Limit Bypass VulnerabilityVaultCVE-2025-6015fixed in 1.20.1Low 3.1Jun 26, 2025Vault Community Edition rekey and recovery key operations can cause denial of serviceVaultCVE-2025-4656fixed in 1.20.0High 8.1Jun 11, 2025Hashicorp Nomad Incorrect Privilege Assignment vulnerabilityNomadCVE-2025-4922fixed in 1.10.2Medium 6.6May 2, 2025Hashicorp Vault Community vulnerable to Incorrect AuthorizationVaultCVE-2025-3879fixed in 1.19.1Medium 4.5May 2, 2025Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive InformationVaultCVE-2025-4166fixed in 1.19.3Medium 6.5Mar 10, 2025Nomad: secrets in logsNomadCVE-2025-1296no fix yetMedium 6.5Dec 20, 2024Hashicorp Nomad Incorrect Privilege Assignment vulnerabilityNomadCVE-2024-12678fixed in 1.9.4

The newest 60. Each project page has the full list.

About HashiCorp

HashiCorp, Inc. is an American software company and subsidiary of IBM based in San Francisco, California. HashiCorp provides tools and products that enable developers, operators and security professionals to provision, secure, run and connect cloud-computing infrastructure.

Elsewhere on Ibis: Acquisitions · Paydays · Releases · Repos · TechConf