HashiCorp
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any HashiCorp product.
RSS Feeds for HashiCorp security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in HashiCorp products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by HashiCorp Sorted by Most Security Vulnerabilities since 2018
By the Year
In 2026 there have been 0 vulnerabilities in HashiCorp. Last year, in 2025 HashiCorp had 23 security vulnerabilities published. Right now, HashiCorp is on track to have less security vulnerabilities in 2026 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 23 | 7.07 |
| 2024 | 24 | 6.38 |
| 2023 | 30 | 6.44 |
| 2022 | 31 | 7.16 |
| 2021 | 32 | 7.12 |
| 2020 | 27 | 7.43 |
| 2019 | 5 | 8.06 |
| 2018 | 4 | 7.28 |
It may take a day or so for new HashiCorp vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent HashiCorp Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2025-13357 | Nov 21, 2025 |
Vault Terraform Provider LDAP DenyNullBind FALSE default before v5.5.0Vaults Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. This vulnerability, CVE-2025-13357, is fixed in Vault Terraform Provider v5.5.0. |
|
| CVE-2025-13432 | Nov 21, 2025 |
Terraform Enterprise state version privilege escalation (pre-1.1.1)Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the alteration of infrastructure if a subsequent plan operation is approved by a user with approval permission or auto-applied. This vulnerability, CVE-2025-13432, is fixed in Terraform Enterprise version 1.1.1 and 1.0.3. |
Terraform Enterprise
|
| CVE-2025-11374 | Oct 28, 2025 |
Consul DoS via KV Endpoint CVE202511374 (Fixed in v1.22.0)Consul and Consul Enterprises (Consul) key/value endpoint is vulnerable to denial of service (DoS) due to incorrect Content Length header validation. This vulnerability, CVE-2025-11374, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12. |
Consul
|
| CVE-2025-11375 | Oct 28, 2025 |
Consul DoS via Unbounded Content-Length; V1.22.0+ FixesConsul and Consul Enterprises (Consul) event endpoint is vulnerable to denial of service (DoS) due to lack of maximum value on the Content Length header. This vulnerability, CVE-2025-11375, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12. |
Consul
|
| CVE-2025-12044 | Oct 23, 2025 |
Vault CE 1.21.0 / Enterprise 1.21.0: JSON DOS (unauthenticated)Vault and Vault Enterprise (Vault) are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for [+HCSEC-2025-24+|https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393] which allowed for processing JSON payloads before applying rate limits. This vulnerability, CVE-2025-12044, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.16.27, 1.19.11, 1.20.5, and 1.21.0. |
Vault
|
| CVE-2025-11621 | Oct 23, 2025 |
Vault AWS Auth Bypass (CVE-2025-11621) fixed 1.21.0/1.20.5/1.19.11/1.16.27Vault and Vault Enterprises (Vault) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS accounts, or uses a wildcard. This vulnerability, CVE-2025-11621, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27 |
Vault
|
| CVE-2025-6203 | Aug 28, 2025 |
Vault Memory Exhaustion via Large Payload (1.20.3+ Vulnerable)A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in excessive memory and CPU consumption of Vault. This may lead to a timeout in Vaults auditing subroutine, potentially resulting in the Vault server to become unresponsive. This vulnerability, CVE-2025-6203, is fixed in Vault Community Edition 1.20.3 and Vault Enterprise 1.20.3, 1.19.9, 1.18.14, and 1.16.25. |
Vault
|
| CVE-2025-8959 | Aug 15, 2025 |
HashiCorp go-getter 1.7.9: Symlink attack in subdirectory downloadHashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9. |
Go Getter
|
| CVE-2025-6013 | Aug 06, 2025 |
Vault LDAP MFA Bypass via username_as_alias; fixed in CE 1.20.2Vault and Vault Enterprises (Vault) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault Enterprise 1.20.2, 1.19.8, 1.18.13, and 1.16.24. |
Vault
|
| CVE-2025-5999 | Aug 01, 2025 |
Vault Privilege Escalation via Identity Endpoint (pre-1.20.0)A privileged Vault operator with write permissions to the root namespaces identity endpoint could escalate their own or another users token privileges to Vaults root policy. Fixed in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11 and 1.16.22. |
Vault
|
| CVE-2025-6000 | Aug 01, 2025 |
Vault Privileged Operator RCE via Plugin Directory (before 1.20.1)A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vaults configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23. |
Vault
|
| CVE-2025-6004 | Aug 01, 2025 |
Vault Userpass/LDAP Lockout Bypass before 1.20.1Vault and Vault Enterprises (Vault) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23. |
Vault
|
| CVE-2025-6011 | Aug 01, 2025 |
Vault Userpass Auth Timing Side Channel Username EnumerationA timing side channel in Vault and Vault Enterprises (Vault) userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vaults Userpass auth method. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23. |
Vault
|
| CVE-2025-6014 | Aug 01, 2025 |
Vault TOTP Engine Code Reuse Vulnerability (Replay) – Fixed 1.20.1Vault and Vault Enterprises (Vault) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23. |
Vault
|
| CVE-2025-6015 | Aug 01, 2025 |
Vault MFA Rate Limit Bypass & TOTP Reuse (CVE-2025-6015) before 1.20.1Vault and Vault Enterprises (Vault) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23. |
Vault
|
| CVE-2025-6037 | Aug 01, 2025 |
TLS Cert Auth Issue in Vault 1.18.12-1.20.1Vault and Vault Enterprise (Vault) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [+trusted certificate+|https://developer.hashicorp.com/vault/api-docs/auth/cert#certificate]. In this configuration, an attacker may be able to craft a malicious certificate that could be used to impersonate another user. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23. |
Vault
|
| CVE-2025-4656 | Jun 25, 2025 |
Vault DoS via Uncontrolled Cancellation in Rekey Ops Before 1.20.0Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22. |
Vault
|
| CVE-2025-4922 | Jun 11, 2025 |
Nomad ACL Prefix Shadowing CVE-2025-4922 – Fixed 1.10.2Nomad Community and Nomad Enterprise (Nomad) prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14. |
Nomad
|
| CVE-2025-3744 | May 13, 2025 |
Nomad Enterprise Bypasses Sentinel Policies via Policy Override (before 1.10.1)Nomad Enterprise (Nomad) jobs using the policy override option are bypassing the mandatory sentinel policies. This vulnerability, identified as CVE-2025-3744, is fixed in Nomad Enterprise 1.10.1, 1.9.9, and 1.8.13. |
Nomad
|
| CVE-2025-3879 | May 02, 2025 |
Vault Azure Auth Claims Validation Bypass (1.19.1+)Vault Community, Vault Enterprise (Vault) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18. |
Vault
|
| CVE-2025-4166 | May 02, 2025 |
Vault KV Plugin v2 Log Exposure via Malformed API Payloads - Fixed in 1.19.3Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20. |
Vault
|
| CVE-2025-1296 | Mar 10, 2025 |
Nomad unintentional token exposure in audit logs (fixed in 1.9.7)Nomad Community and Nomad Enterprise (Nomad) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19. |
Nomad
|
| CVE-2025-0937 | Feb 12, 2025 |
Nomad ACL Bypass via Wildcard Namespace in Event StreamNomad Community and Nomad Enterprise ("Nomad") event stream configured with a wildcard namespace can bypass the ACL Policy allowing reads on other namespaces. |
Nomad
|
| CVE-2024-12678 | Dec 20, 2024 |
HashiCorp Nomad Privilege Escalation via Unredacted Workload Identity TokensNomad Community and Nomad Enterprise ("Nomad") allocations are vulnerable to privilege escalation within a namespace through unredacted workload identity tokens. This vulnerability, identified as CVE-2024-12678, is fixed in Nomad Community Edition 1.9.4 and Nomad Enterprise 1.9.4, 1.8.8, and 1.7.16. |
Nomad
|
| CVE-2024-12289 | Dec 12, 2024 |
Boundary Controller Initialization HTTP Request Handling Denial of Service VulnerabilityBoundary Community Edition and Boundary Enterprise (Boundary) incorrectly handle HTTP requests during the initialization of the Boundary controller, which may cause the Boundary server to terminate prematurely. Boundary is only vulnerable to this flaw during the initialization of the Boundary controller, which on average is measured in milliseconds during the Boundary startup process. This vulnerability, CVE-2024-12289, is fixed in Boundary Community Edition and Boundary Enterprise 0.16.4, 0.17.3, 0.18.2. |
Boundary
|
| CVE-2024-10975 | Nov 07, 2024 |
Nomad 1.9.2: Arbitrary Cross-Namespace Volume CreationNomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container Storage Interface (CSI) volume writes. This vulnerability, identified as CVE-2024-10975, is fixed in Nomad Community Edition 1.9.2 and Nomad Enterprise 1.9.2, 1.8.7, and 1.7.15. |
Nomad
|
| CVE-2024-8185 | Oct 31, 2024 |
Vault: DoS via Raft join API (before 1.18.1)Vault Community and Vault Enterprise (Vault) clusters using Vaults Integrated Storage backend are vulnerable to a denial-of-service (DoS) attack through memory exhaustion through a Raft cluster join API endpoint . An attacker may send a large volume of requests to the endpoint which may cause Vault to consume excessive system memory resources, potentially leading to a crash of the underlying system and the Vault process itself. This vulnerability, CVE-2024-8185, is fixed in Vault Community 1.18.1 and Vault Enterprise 1.18.1, 1.17.8, and 1.16.12. |
Vault
|
| CVE-2024-10086 | Oct 30, 2024 |
Consul XSS via Missing Content-Type HeaderA vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS. |
Consul
|
| CVE-2024-10006 | Oct 30, 2024 |
Consul L7 Intentions Header BypassA vulnerability was identified in Consul and Consul Enterprise (Consul) such that using Headers in L7 traffic intentions could bypass HTTP header based access rules. |
Consul
|
| CVE-2024-10005 | Oct 30, 2024 |
Consul L7 Intent Path Bypass HTTP Path RulesA vulnerability was identified in Consul and Consul Enterprise (Consul) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules. |
Consul
|
| CVE-2024-10228 | Oct 29, 2024 |
Vagrant VMWare Utility 1.0.23 Windows Installer Path TraversalThe Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing potential for unauthorized file system writes. This vulnerability, CVE-2024-10228, was fixed in Vagrant VMWare Utility 1.0.23 |
Vagrant Vmware Utility
|
| CVE-2024-9180 | Oct 10, 2024 |
Vault Priv Escalation via Root Namespace Identity Endpoint (Fixed 1.18.0)A privileged Vault operator with write permissions to the root namespaces identity endpoint could escalate their own or another users privileges to Vaults root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16. |
Vault
|
| CVE-2024-7594 | Sep 26, 2024 |
HashiCorp Vault SSH SE valid_principals flaw any host auth (pre-1.17.6)Vaults SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vaults SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15. |
Vault
|
| CVE-2024-8365 | Sep 02, 2024 |
Vault 1.17.5/1.16.9 HMAC Audit Log Regression CVE-2024-8365Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMACd sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being stored in the audit log. This vulnerability, CVE-2024-8365, was fixed in Vault Community Edition and Vault Enterprise 1.17.5 and Vault Enterprise 1.16.9. |
Vault
|
| CVE-2024-7625 | Aug 15, 2024 |
Nomad 0.6.11.8.2 Crash Directory Traversal CVE20247625In HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.6.13, 1.7.10, and 1.8.2, the archive unpacking process is vulnerable to writes outside the allocation directory during migration of allocation directories when multiple archive headers target the same file. This vulnerability, CVE-2024-7625, is fixed in Nomad 1.6.14, 1.7.11, and 1.8.3. Access or compromise of the Nomad client agent at the source allocation first is a prerequisite for leveraging this vulnerability. |
Nomad
|
| CVE-2024-6717 | Jul 23, 2024 |
Nomad Archive Unpack Path Escaping CVE-2024-6717 (Alloc Dir)HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to path escaping of the allocation directory. This vulnerability, CVE-2024-6717, is fixed in Nomad 1.6.13, 1.7.10, and 1.8.2. |
Nomad
|
| CVE-2024-6468 | Jul 11, 2024 |
Vault DoS via proxy_protocol_behavior deny_unauthorized before 1.17.2Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP listener option, proxy_protocol_behavior, was set to deny_unauthorized. When receiving a request from a source IP address that was not listed in proxy_protocol_authorized_addrs, the Vault API server would shut down and no longer respond to any HTTP requests, potentially resulting in denial of service. While this bug also affected versions of Vault up to 1.17.1 and 1.16.5, a separate regression in those release series did not allow Vault operators to configure the deny_unauthorized option, thus not allowing the conditions for the denial of service to occur. Fixed in Vault and Vault Enterprise 1.17.2, 1.16.6, and 1.15.12. |
Vault
|
| CVE-2024-6257 | Jun 25, 2024 |
HashiCorp go-getter arbitrary code exec via coerced Git updateHashiCorps go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution. |
Go Getter
|
| CVE-2024-6104 | Jun 24, 2024 |
HashiCorp go-retryablehttp <0.7.7 logs Basic Auth creds (CVE-2024-6104)go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7. |
Retryablehttp
|
| CVE-2024-5798 | Jun 12, 2024 |
Vault JWT Auth: Audience Claim Validation Bypass before 1.17.0Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected. This vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0, 1.16.3, and 1.15.9 |
Vault
|
| CVE-2024-2877 | Apr 30, 2024 |
Vault Enterprise 1.15.8: Standby Audit Logs Sensitive HTTP HeadersVault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log request headers on the standby node. These logs may have included sensitive HTTP request information in cleartext. This vulnerability, CVE-2024-2877, was fixed in Vault Enterprise 1.15.8. |
Vault
|
| CVE-2024-3817 | Apr 17, 2024 |
HashiCorp Go-getter Arg Injection via GitHashiCorps go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package. |
Go Getter
|
| CVE-2024-2660 | Apr 04, 2024 |
Vault TLS Auth OCSP Validation Flaw v1.14.0-<1.16.0Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11. |
Vault
|
| CVE-2024-2048 | Mar 04, 2024 |
Vault TLS Cert Auth Bypass (1.15.5/1.14.10)Vault and Vault Enterprise (Vault) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate. In this configuration, an attacker may be able to craft a malicious certificate that could be used to bypass authentication. Fixed in Vault 1.15.5 and 1.14.10. |
Vault
|
| CVE-2024-1329 | Feb 08, 2024 |
Nomad Renderer Arbitrary File Write via Symlink (CVE-2024-1329)HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. This vulnerability, CVE-2024-1329, is fixed in Nomad 1.7.4, 1.6.7, and 1.5.14. |
Nomad
|
| CVE-2024-1052 | Feb 05, 2024 |
Boundary TLS Cert Tampering Enables Session Hijacking (CVE-2024-1052)Boundary and Boundary Enterprise (Boundary) is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use (TOFU) token may craft a TLS certificate to hijack an active session and gain access to the underlying service or application. |
Boundary
|
| CVE-2024-0831 | Feb 01, 2024 |
Vault Log_RAW Audit Device May Expose Sensitive DataVault and Vault Enterprise (Vault) may expose sensitive information when enabling an audit device which specifies the `log_raw` option, which may log sensitive information to other audit devices, regardless of whether they are configured to use `log_raw`. |
Vault
|
| CVE-2023-6337 | Dec 08, 2023 |
Vault HTTP DoS via memory exhaustion 1.12.0+HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash. Fixed in Vault 1.15.4, 1.14.8, 1.13.12. |
Vault
|
| CVE-2023-5332 | Dec 04, 2023 |
GitLab EE Consul enable-script-checks BypassPatch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE. |
Consul
|
| CVE-2023-5954 | Nov 09, 2023 |
HashiCorp Vault memory exhaustion via policy check (DDoS) - before 1.15.2HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10. |
Vault
|