CVEvulnerability

CVE-2026-5052

8.6 HIGH Published 2026-04-17 Modified 2026-10-26 Official page ↗
Status
Analyzed
Published
2026-04-17
Last modified
2026-10-26
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1 ([email protected])
8.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-918

Description

Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

Affected configurations

• hashicorp vault (>= 1.14.0 < 1.19.16) • hashicorp vault (>= 1.14.0 < 2.0.0) • hashicorp vault (>= 1.20.0 < 1.20.10) • hashicorp vault (>= 1.21.0 < 1.21.5)

Related

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References