GHSA-8r5m-3f66-qpr3 BIT-vault-2026-5052 CVE-2026-5052 GO-2026-5262
HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS
- Severity
- 5.3 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.34%
- Chance of exploitation in the next 30 days. Higher than 28.11% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-918 Server-Side Request Forgery (SSRF)
- Fix
- None yet
- No fixed version published
Description
Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/hashicorp/vault | >= 1.14.0, <= 1.21.4 |
No fix yet |
| github.com/hashicorp/vault | >= 1.14.0 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Weakness
CWE-918: Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-88v5-9hxc-f85r HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations | High | Also affects github.com/hashicorp/vault |
| GHSA-72gw-fmmr-c4r4 HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization | High | Also affects github.com/hashicorp/vault |
| GHSA-m2w4-8ggf-rj47 HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service | High | Also affects github.com/hashicorp/vault |
| GHSA-vp5w-xcfc-73wf Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON | High | Also affects github.com/hashicorp/vault |
| GHSA-9g4h-h484-3578 HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass | High | Also affects github.com/hashicorp/vault |
| GHSA-8f82-53h8-2p34 HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads | High | Also affects github.com/hashicorp/vault |
| GHSA-7rx2-769v-hrwf HashiCorp Vault ldap auth method may not have correctly enforced MFA | High | Also affects github.com/hashicorp/vault |
| GHSA-6c5r-4wfc-3mcx Hashicorp Vault has Incorrect Validation for Non-CA Certificates | Medium | Also affects github.com/hashicorp/vault |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor