GitHub Advisoryadvisory · Go
GHSA-8r5m-3f66-qpr3 HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS
MEDIUM
Official page ↗
- Aliases
- CVE-2026-5052
- Ecosystem
- Go
- Packages
- github.com/hashicorp/vault
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-918
- Reviewed
- 2026-04-18
Affected packages
• Go github.com/hashicorp/vault: >= 1.14.0, <= 1.21.4 (no fix yet)
Description
Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
Related
Alias · CVE (1)
- CVE-2026-5052 Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. vulnerability
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-5052 advisory
- https://discuss.hashicorp.com/t/hcsec-2026-06-vault-vulnerable-to-server-side-request-forgery-in-acme-challenge-validation-via-attacker-controlled-dns/77343 web
- https://github.com/advisories/GHSA-8r5m-3f66-qpr3 advisory
- https://github.com/hashicorp/vault package