CVEvulnerability

CVE-2026-5051

4.4 MEDIUM Published 2026-07-01 Modified 2026-07-02 Official page ↗
Status
Deferred
Published
2026-07-01
Last modified
2026-07-02
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.4 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22

Description

HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used. This vulnerability (CVE-2026-5051) is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17.

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References