HashiCorp security advisories

31 advisories · 15 critical or high in 12 months · latest Sep 15

31 advisories

Date	Advisory	Severity	Fixed in
Sep 15	HashiCorp Shared library: privilege escalation Medium6.7Sep 15 CVE-2026-889222.2.4	Medium6.7	2.2.4
Sep 10	HashiCorp Tooling: information disclosure High7.7Sep 10 CVE-2026-879930.43.0	High7.7	0.43.0
Sep 10	Consul and Consul Enterprise are vulnerable to an authorization bypass in the... High7.1Sep 10 CVE-2026-880212.0.4+1 more	High7.1	2.0.4+1 more
Sep 10	HashiCorp Consul: improper authorization High8.3Sep 10 CVE-2026-870902.0.4+1 more	High8.3	2.0.4+1 more
Sep 10	HashiCorp Consul: denial of service Medium6.5Sep 10 CVE-2026-871062.0.4+1 more	Medium6.5	2.0.4+1 more
Sep 10	HashiCorp Consul: improper authorization Medium5.4Sep 10 CVE-2026-871072.0.4+1 more	Medium5.4	2.0.4+1 more
Aug 24	HashiCorp Vault: insecure direct object reference Medium6.8Aug 24 CVE-2026-50062.0.4+1 more	Medium6.8	2.0.4+1 more
Aug 17	HashiCorp Packer: code execution High7.1Aug 17 CVE-2026-195891.16.0	High7.1	1.16.0
Aug 13	HashiCorp Tooling: arbitrary file read Critical9.6Aug 13 CVE-2026-87151.5.0	Critical9.6	1.5.0
Aug 10	HashiCorp Vault Enterprise: missing authorization High8.2Aug 10 CVE-2026-148862.0.4	High8.2	2.0.4
Aug 10	HashiCorp Vault: improper authorization Medium4.3Aug 10 CVE-2026-126242.0.3+1 more	Medium4.3	2.0.3+1 more
Aug 7	HashiCorp Consul: denial of service High7.5Aug 7 CVE-2026-159722.0.3+1 more	High7.5	2.0.3+1 more
Aug 7	HashiCorp Consul: denial of service Medium5.3Aug 7 CVE-2026-190122.0.3+1 more	Medium5.3	2.0.3+1 more
Aug 7	HashiCorp Consul: resource exhaustion Medium4.3Aug 7 CVE-2026-190142.0.3+1 more	Medium4.3	2.0.3+1 more
Aug 7	HashiCorp Consul: resource exhaustion Medium5.3Aug 7 CVE-2026-190152.0.3+1 more	Medium5.3	2.0.3+1 more
Aug 7	HashiCorp Consul: path traversal Medium4.2Aug 7 CVE-2026-190162.0.3+1 more	Medium4.2	2.0.3+1 more
Aug 7	HashiCorp Consul: arbitrary file read Medium6.8Aug 7 CVE-2026-190172.0.3+1 more	Medium6.8	2.0.3+1 more
Aug 7	HashiCorp Consul: denial of service Medium5.3Aug 7 CVE-2026-191132.0.3+1 more	Medium5.3	2.0.3+1 more
Aug 7	Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are... Medium4.2Aug 7 CVE-2026-159702.0.3+1 more	Medium4.2	2.0.3+1 more
Jul 29	HashiCorp Tooling: server-side request forgery High8.6Jul 29 CVE-2026-163280.1.4	High8.6	0.1.4
Jul 29	In consul-mcp-server Critical10.0Jul 29 CVE-2026-163260.1.4	Critical10.0	0.1.4
Jul 28	The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant... Critical10.0Jul 28 CVE-2026-164981.1.0	Critical10.0	1.1.0
Jul 28	HashiCorp Tooling: server-side request forgery High8.6Jul 28 CVE-2026-148691.1.0	High8.6	1.1.0
Jul 28	HashiCorp Tooling: session fixation High8.9Jul 28 CVE-2026-164961.1.0	High8.9	1.1.0
Jul 8	HashiCorp Nomad: improper authorization Medium4.2Jul 8 CVE-2026-148962.0.4+1 more	Medium4.2	2.0.4+1 more
Jul 8	HashiCorp Nomad: missing authorization High7.7Jul 8 CVE-2026-143732.0.4+1 more	High7.7	2.0.4+1 more
Jul 8	HashiCorp Nomad: link following High8.7Jul 8 CVE-2026-148912.0.4+1 more	High8.7	2.0.4+1 more
Jul 8	HashiCorp Tooling: link following Medium4.7Jul 8 CVE-2026-143610.42.1	Medium4.7	0.42.1
Jul 8	HashiCorp Shared library: denial of service Medium4.9Jul 8 CVE-2026-143620.6.0	Medium4.9	0.6.0
Jul 6	HashiCorp Terraform Enterprise: path traversal High7.7Jul 6 CVE-2026-144682.0.4	High7.7	2.0.4
Jul 1	HashiCorp Vault: path traversal Medium4.4Jul 1 CVE-2026-50512.0.1+1 more	Medium4.4	2.0.1+1 more

About HashiCorp

Security advisories HashiCorp publishes for its own products.

discuss.hashicorp.com/c/security/52 HashiCorp

HashiCorp elsewhere on fru.dev: Acquisitions · Paydays · Releases · Repos · TechConf

Critical advisories by email