[ Vendor · 5 CVEs ]
HashiCorp
CVEs affecting HashiCorp published in the last 30 days, plus any HashiCorp CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-19585 | 8 Oct 2026 | CVSS 5.3 | HashiCorp Shared libraryHashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory… | |
| CVE-2026-89322 | 7 Oct 2026 | CVSS 7.2 | HashiCorp VaultVault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an… | |
| CVE-2026-105816 | 7 Oct 2026 | CVSS 8.0 | HashiCorp VaultVault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory… | |
| CVE-2026-105818 | 7 Oct 2026 | CVSS 5.9 | HashiCorp VaultVault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under… | |
| CVE-2026-105820 | 7 Oct 2026 | CVSS 5.4 | HashiCorp Vault EnterpriseVault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially… |