Vault

This hub aggregates every CVE we track for Vault, a product in the cloud saas space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Vault.

• CVE-2026-5807Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations7.5Apr 17, 2026
• CVE-2026-4525Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header7.5Apr 17, 2026
• CVE-2026-5052Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS5.3Apr 17, 2026
• CVE-2026-3605Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service8.1Apr 17, 2026
• CVE-2025-4656Vault Vulnerable to Recovery Key Cancellation Denial of Service3.1Jun 25, 2025
• CVE-2025-4166Vault May Include Sensitive Data in Error Logs When Using the KV v2 Plugin4.5May 2, 2025
• CVE-2023-5077Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets7.6Sep 28, 2023
• CVE-2023-2121Vault’s KV Diff Viewer Allowed for HTML Injection4.3Jun 9, 2023
• CVE-2023-2197Vault Enterprise Vulnerable to Padding Oracle Attacks When Using a CBC-based Encryption Mechanism with a HSM2.5May 1, 2023
• CVE-2023-0620Vault Vulnerable to SQL Injection When Configuring the Microsoft SQL Database Storage Backend6.5Mar 30, 2023
• CVE-2023-0665Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata6.5Mar 30, 2023
• CVE-2021-45042In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters using the Integrated Storage backend allowed an authenticated user (with write permissions...4.9Dec 17, 2021
• CVE-2021-43998HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity an...6.5Nov 30, 2021
• CVE-2021-42135HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have mo...8.1Oct 11, 2021
• CVE-2021-41802HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s pol...2.9Oct 8, 2021