News · HashiCorp security bulletins
-
HashiCorp security bulletins
HCSEC-2026-50 - Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules
Bulletin ID: HCSEC-2026-50 Affected Products / Versions: consul-k8s 0.42.0 up to 2.0.4; fixed in consul-k8s 1.8.18 and 2.1.0 Publication Date: October 26, 2026 Summary Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18. Background When system ACL management is enabled, consul-k8s configures Kubernetes authentication and Consul ACL binding rules so its components can obtain Consul…
CVE-2026-110720 -
HashiCorp security bulletins
HCSEC-2026-49 - Consul vulnerable to an authorization bypass in health check registration
Bulletin ID: HCSEC-2026-49 Affected Products / Versions: Consul and Consul Enterprise 0.7.2 up to 2.0.4; fixed in Consul 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19 Publication Date: October 26, 2026 Summary HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability (CVE-2026-115804) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19. Background Consul health checks report the status…
CVE-2026-115804 -
HashiCorp security bulletins
HCSEC-2026-48 - Consul vulnerable to a denial of service in HTTP APIs
Bulletin ID: HCSEC-2026-48 Affected Products / Versions: Consul and Consul Enterprise up to 2.0.4; fixed in Consul 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19 Publication Date: October 26, 2026 Summary HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19. Background Consul client and server agents expose an HTTP API for operations such as registering serv…
CVE-2026-105626 -
HashiCorp security bulletins
HCSEC-2026-47 - Consul vulnerable to an authorization bypass in service mesh registration
Bulletin ID: HCSEC-2026-47 Affected Products / Versions: Consul 2.0.4 and Consul Enterprise 2.0.4, 1.22.12 and 1.21.18; fixed in Consul 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19 Publication Date: October 26, 2026 Summary HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission. This vulnerability (CVE-2026-105608) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19…
CVE-2026-105608 -
HashiCorp security bulletins
HCSEC-2026-46 - Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API
Bulletin ID: HCSEC-2026-46 Affected Products / Versions: Consul and Consul Enterprise 1.17.0 up to 2.0.4; fixed in Consul 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19 Publication Date: October 26, 2026 Summary HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent’s service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19…
CVE-2026-105765 -
HashiCorp security bulletins
HCSEC-2026-45 - Updates to HashiCorp subprocessors
Bulletin ID: HCSEC-2026-45 Publication Date: October 13, 2026 Summary As part of HashiCorp’s ongoing commitment to privacy and transparency, we have updated our subprocessors list. These updates include details about the following subprocessors: Entity Description Action Taken Products Affected Shopify Cloud-based commerce platform Removed All Products Zendesk Customer support Removed All Products For customers using IBM branded contracts, a list of HashiCorp’s subprocessors for each product will be available via IBMs Software Product Compatibility Reports page. No action is required. You can…
-
HashiCorp security bulletins
HCSEC-2026-44 - Go-getter vulnerable to a path traversal in S3/GCS directory download handling
Bulletin ID: HCSEC-2026-44 Affected Products / Versions: Go-getter up to 1.8.9 and 2.2.4; fixed in go-getter 1.8.10 and 2.2.5 Publication Date: October 8, 2026 Summary HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability (CVE-2026-19585) is fixed in go-getter 1.8.10 and go-getter/v2 2.2.5. Background Go-getter is a Go library for downloading files and directories from sources including Amazon S3 and Googl…
CVE-2026-19585 -
HashiCorp security bulletins
HCSEC-2026-43 - Vault Inconsistent ACL Policy Evaluation May Allow Bypass of Deny Restrictions
Bulletin ID: HCSEC-2026-43 Affected Products / Versions: Vault Community Edition up to 2.1.1; fixed in Vault Community Edition 2.1.2. Vault Enterprise up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Publication Date: October 7, 2026 Summary Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy, potentially leading to privilege escalat…
-
HashiCorp security bulletins
HCSEC-2026-42 - Vault Enterprise ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution
Bulletin ID: HCSEC-2026-42 Affected Products / Versions: Vault Enterprise up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Publication Date: October 7, 2026 Summary Vault’s ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability (CVE-2026-105820) is fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Vault Community Edition does not sup…
CVE-2026-105820 -
HashiCorp security bulletins
HCSEC-2026-41 - Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots
Bulletin ID: HCSEC-2026-41 Affected Products / Versions: Vault Community Edition and Vault Enterprise up to 2.1.1; fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Publication Date: October 7, 2026 Summary Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory configured, a privileged operator able to restore an Integrated Storage (Raft) snapshot may be able to execute arbitrary code on…
-
HashiCorp security bulletins
HCSEC-2026-40 - Vault PKI ACME Default Directory Policy May Issue Certificates With Unverified Identities
Bulletin ID: HCSEC-2026-40 Affected Products / Versions: Vault Community Edition 1.14.0 up to 2.1.1; fixed in Vault Community Edition 2.1.2. Vault Enterprise 1.14.0 up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Publication Date: October 7, 2026 Summary Vault’s PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling impersonation toward sy…
-
HashiCorp security bulletins
HCSEC-2026-39 - Go-getter vulnerable to a privilege escalation issue in its archive decompression handling
Bulletin ID: HCSEC-2026-39 Affected Products / Versions: Go-getter up to 1.8.8 and 2.2.3; fixed in go-getter 1.8.9 and 2.2.4 Publication Date: September 15, 2026 Summary The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-gette…
CVE-2026-88922 -
HashiCorp security bulletins
HCSEC-2026-38 - Consul-template vulnerable to an information disclosure issue in error handling
Bulletin ID: HCSEC-2026-38 Affected Products / Versions: consul-template 0.27.2 through 0.42.1; fixed in consul-template 0.43.0 Publication Date: September 10, 2026 Summary The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability (CVE-2026-87993) is fixed in consul-template 0.43.0. Background Consul-template renders Vault secrets into configuration files using a templating engine. When a templa…
CVE-2026-87993 -
HashiCorp security bulletins
HCSEC-2026-37 - Consul vulnerable to an authorization bypass in the Connect service mesh
Bulletin ID: HCSEC-2026-37 Affected Products / Versions: Consul and Consul Enterprise 1.9.0 through 2.0.3; fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4. Publication Date: September 10, 2026 Summary Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not authorized to access. When building Envoy RBAC rules to enforce Connect intentions, Consul did not correctly escape certain characters in service names, namespaces, and partitions, causing the generated authorization…
-
HashiCorp security bulletins
HCSEC-2026-36 - Consul vulnerable to an authorization bypass in the catalog deregistration path
Bulletin ID: HCSEC-2026-36 Affected Products / Versions: Consul and Consul Enterprise 1.21.0 through 2.0.3; fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4. Publication Date: September 10, 2026 Summary Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-imported catalog objects. A caller with service:write or node:write permission may exploit this issue to remove services, checks, or nodes imported from a peered cluster without holding authority over the peer origin. T…
-
HashiCorp security bulletins
HCSEC-2026-35 - Consul vulnerable to a denial of service in the native RPC listener
Bulletin ID: HCSEC-2026-35 Affected Products / Versions: Consul and Consul Enterprise 1.21.0 through 2.0.3; fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4. Publication Date: September 10, 2026 Summary Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory before ACL authorization is evaluated. A client that can complete the internal RPC mTLS handshake may exploit this issue without holding a valid ACL token. This vulnerability (CVE-2026-87106) is fixed in Consul 2.0.…
CVE-2026-87106 -
HashiCorp security bulletins
HCSEC-2026-34 - Consul vulnerable to an authorization bypass in the catalog node-write path
Bulletin ID: HCSEC-2026-34 Affected Products / Versions: Consul and Consul Enterprise up to 2.0.3; fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4. Publication Date: September 10, 2026 Summary Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node’s catalog registration and take over its node identity. An attacker with a token granting node-write permission on any single node name may exploit this issue if they can obtain the node ID of a node they do not cont…
-
HashiCorp security bulletins
HCSEC-2026-33 - HashiCorp Linux Signing GPG Key Update (CA026560)
Bulletin ID: HCSEC-2026-33 Publication Date: September 10, 2026 Last Updated: September 11, 2026 Summary Action is required for customers who install HashiCorp software via our Linux APT or RPM repositories. The HashiCorp GPG key used to sign Linux packages was rotated on September 10th, 2026. The new key fingerprint is D55C 0D1A C78A 8D81 26CB 631C FC9C A96A CA02 6560. The new key fingerprint is also available on our Trust Page (https://www.hashicorp.com/en/trust/security). Background The key rotation was carried out as a precaution following a security incident affecting part of our interna…
-
HashiCorp security bulletins
HCSEC-2026-32 - Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths
Bulletin ID: HCSEC-2026-32 Affected Products / Versions: Vault Community Edition from 0.11.0 up to 2.0.3; fixed in 2.0.4. Vault Enterprise from 0.11.0 up to 2.0.3, 1.21.8, 1.20.13, and 1.19.19; fixed in 2.0.4, 1.21.9, 1.20.14, and 1.19.20. Publication Date: August 24, 2026 Summary A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include slash (/) charact…
-
HashiCorp security bulletins
HCSEC-2026-31 - Go-slug vulnerable to exclusion bypass in .terraformignore handling
Bulletin ID: HCSEC-2026-31 Affected Products / Versions: github.com/hashicorp/go-slug v0.4.0 through v0.18.2; fixed in v0.18.3. Publication Date: August 20, 2026 Summary The github.com/hashicorp/go-slug library before v0.18.3 is vulnerable to an exclusion bypass in .terraformignore handling that may allow files intended to be excluded from Terraform Cloud or Terraform Enterprise working directory uploads to be included instead on affected macOS filesystems. This issue requires a local working directory whose filenames and ignore patterns differ only by Unicode normalization, and is most relev…
-
HashiCorp security bulletins
HCSEC-2026-30 - Updates to HashiCorp subprocessors
Bulletin ID: HCSEC-2026-30 Publication Date: August 18, 2026 Summary As part of HashiCorp’s ongoing commitment to privacy and transparency, we have updated our subprocessors list. These updates include details about the following subprocessors: Entity Description Action Taken Products Affected NetSuite Billing and accounting Removed All Products Replicated Installation and packaging Removed Terraform Enterprise Stripe PAYGO Payment processing Removed HCP, HCP Terraform FastSpring E-commerce platform Added HCP, HCP Terraform For customers using IBM branded contracts, a list of HashiCorp’s subp…
-
HashiCorp security bulletins
HCSEC-2026-29 - Packer vulnerable to arbitrary file write via crafted plugin archive during installation
Bulletin ID: HCSEC-2026-29 Affected Products / Versions: Packer 1.7.0 up to 1.15.4; fixed in Packer 1.16.0 Publication Date: August 17, 2026 Summary Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability (CVE-2026-19589) is fixed in Packer 1.16.0. Background Packer supports third-party plugins that can be installed directly from GitHub-hosted releases using packer init or packer p…
CVE-2026-19589 -
HashiCorp security bulletins
HCSEC-2026-28 - Vault Secrets Operator vulnerable to arbitrary file read via AppRole secretIDPath
Bulletin ID: HCSEC-2026-28 Affected Products / Versions: Vault Secrets Operator 1.3.0 up to 1.4.1; fixed in Vault Secrets Operator 1.5.0. Publication Date: August 13, 2026 Summary Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod’s filesystem and transmit their contents to a tenant-controlled endpoint, potentially leading to privilege escalation within the cluster. This vulnerability (C…
-
HashiCorp security bulletins
HCSEC-2026-27 - Vault Enterprise vulnerable to cross-namespace entity deletion
Bulletin ID: HCSEC-2026-27 Affected Products / Versions: Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16 LTS, up to 2.0.3, 1.21.8, 1.20.13, and 1.19.19 LTS; fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20. Publication Date: August 10, 2026 Summary Vault Enterprise’s identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability (CVE-2026-14886) is fixed in Vault Enterprise 2.0.4, 1.21.9…
CVE-2026-14886 -
HashiCorp security bulletins
HCSEC-2026-26 - Vault vulnerable to LIST authorization bypass via trailing-slash strip
Bulletin ID: HCSEC-2026-26 Affected Products / Versions: Vault and Vault Enterprise up to 2.0.2; fixed in Vault 2.0.3 and Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19 Publication Date: August 10, 2026 Summary Vault’s ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was intended to be denied access to. This vulnerability (CVE-2026-12624) is fixed in V…
CVE-2026-12624 -
HashiCorp security bulletins
HCSEC-2026-25 - Multiple vulnerabilities impacting HashiCorp Consul
Bulletin ID: HCSEC-2026-25 Affected Products / Versions: CVE-2026-19012: Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2. CVE-2026-19014: Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2. CVE-2026-19015: Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2. CVE-2026-19017: Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2. CVE-2026-19016: Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2. CVE-2026-15970: Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2. CVE-2026-15972: Consul Community…
CVE-2026-19012, CVE-2026-19014, CVE-2026-19015 +4 -
HashiCorp security bulletins
HCSEC-2026-24 - Multiple vulnerabilities impacting HashiCorp Consul MCP Server
Bulletin ID: HCSEC-2026-24 Affected Products / Versions: consul-mcp-server 0.1.0 up to 0.1.3; fixed in 0.1.4. Publication Date: July 29, 2026 Summary consul-mcp-server versions 0.1.0 up to 0.1.3 are affected by two vulnerabilities. First, the server did not restrict client-supplied overrides of the Consul backend address, which may allow a connected client to redirect Consul API traffic to an attacker-controlled endpoint and potentially exfiltrate the server’s configured Consul token (CVE-2026-16328). Second, the server did not properly isolate session state in stateless mode, which may allow…
CVE-2026-16328 -
HashiCorp security bulletins
HCSEC-2026-23 - Multiple vulnerabilities impacting HashiCorp Terraform MCP Server
Bulletin ID: HCSEC-2026-23 Affected Products / Versions: terraform-mcp-server 0.2.1 up to and including 1.0.0; fixed in 1.1.0. Publication Date: July 28, 2026 Summary The terraform-mcp-server before version 1.1.0 is vulnerable to three related issues in its streamable-HTTP transport: a server-side request forgery issue that may allow an unauthenticated client to redirect the server’s bearer token to an attacker-controlled endpoint (CVE-2026-14869), an authorization bypass in stateful mode that may allow an authenticated user to access another user’s cached Terraform credentials (CVE-2026-1649…
CVE-2026-14869, CVE-2026-1649 -
HashiCorp security bulletins
HCSEC-2026-22 - Nomad vulnerable to cross-namespace host volume claim deletion
Bulletin ID: HCSEC-2026-22 Affected Products / Versions: Nomad and Nomad Enterprise up to 2.0.3; fixed in Nomad 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14. Publication Date: July 8, 2026 Summary HashiCorp Nomad and Nomad Enterprise are vulnerable to a cross-namespace authorization bypass in the dynamic host volumes feature that may allow an operator holding the host volume delete permission in one namespace to delete a sticky volume claim belonging to a job in another namespace. This vulnerability, CVE-2026-14896, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4…
CVE-2026-14896 -
HashiCorp security bulletins
HCSEC-2026-21 - Nomad vulnerable to sandbox escape in Docker task driver
Bulletin ID: HCSEC-2026-21 Affected Products / Versions: Nomad and Nomad Enterprise up to 2.0.3; fixed in Nomad 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14. Publication Date: July 8, 2026 Summary HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job submitter to bind-mount a host path into a container even when volume bind mounts are disabled, potentially leading to reading and writing files on the host. This vulnerability, CVE-2026-14891, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, an…
CVE-2026-14891