GitHub Advisoryadvisory · Go
GHSA-72gw-fmmr-c4r4 HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization
HIGH
Official page ↗
- Aliases
- CVE-2026-4525
- Ecosystem
- Go
- Packages
- github.com/hashicorp/vault
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-201
- Reviewed
- 2026-04-18
Affected packages
• Go github.com/hashicorp/vault: >= 0.11.2, <= 1.21.4 (no fix yet)
Description
If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
Related
Alias · CVE (1)
- CVE-2026-4525 If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to… vulnerability
Weakness · CWE (1)
- CWE-201 Insertion of Sensitive Information Into Sent Data weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-4525 advisory
- https://access.redhat.com/security/cve/CVE-2026-4525 web
- https://bugzilla.redhat.com/show_bug.cgi?id=2459107 web
- https://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344 web
- https://github.com/advisories/GHSA-72gw-fmmr-c4r4 advisory
- https://github.com/hashicorp/vault package
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4525.json web