CVEvulnerability

CVE-2026-4525

8.8 HIGH Published 2026-04-17 Modified 2026-10-25 Official page ↗
Status
Modified
Published
2026-04-17
Last modified
2026-10-25
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-201

Description

If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

Affected configurations

• hashicorp vault (>= 0.11.2 < 1.19.16) • hashicorp vault (>= 0.11.2 < 2.0.0) • hashicorp vault (>= 1.20.0 < 1.20.10) • hashicorp vault (>= 1.21.0 < 1.21.5)

Related

Weakness · CWE (1)

  • CWE-201 Insertion of Sensitive Information Into Sent Data weakness

References