CVE-2026-105818: Vault PKI ACME Issues Certificate With Unvalidated SANs
Summary
CVE-2026-105818: Vault PKI ACME Issues Certificate With Unvalidated SANs. Affects vault versions >= 1.14.0, < 2.1.2. Fixed in 2.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Vault is an open-source tool developed by HashiCorp that provides secrets management, identity-based access, and dynamic secrets. It is widely used for managing sensitive data such as API keys, passwords, and certificates. The PKI (Public Key Infrastructure) secrets engine in Vault allows users to generate and manage certificates. However, it has been found to have a vulnerability in its ACME (Automatic Certificate Management Environment) server that could lead to the issuance of certificates with unverified identity claims.
Vulnerability Detail
The vulnerability arises from the Vault PKI secrets engine ACME server not properly validating certificate identities during the issuance process. This flaw allows an ACME client to obtain a certificate that includes unvalidated Subject Alternative Names (SANs), which could potentially enable impersonation of trusted systems. Attackers could exploit this vulnerability to present themselves as legitimate entities, undermining the trust model of systems relying on these certificates.
How To Fix
Minimum fixed version
2.1.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict the use of the ACME server or manually validate certificate requests until the update can be applied. This may involve implementing additional checks in the certificate issuance process to ensure that only validated identities are allowed.
Conclusion
CVE-2026-105818 is a significant vulnerability in the Vault PKI ACME server that could lead to the issuance of unvalidated certificates, posing a risk of impersonation attacks. Users are strongly advised to update to the latest patched versions of Vault to mitigate this risk.
See every vulnerability recorded for vault →
FAQ
CVE-2026-105818 is a vulnerability in the Vault PKI ACME server that allows the issuance of certificates with unvalidated Subject Alternative Names (SANs).
This vulnerability can lead to impersonation attacks, where an attacker could present a fraudulent certificate to systems that trust certificates issued by the affected Vault PKI mount.
The vulnerability affects Vault versions prior to 2.1.2 for Community Edition and earlier versions of Enterprise Vault, specifically those before 2.1.2, 1.21.12, 1.20.17, and 1.19.23.
You can update your Vault installation by using your package manager or downloading the latest version from the HashiCorp website. Ensure to follow the upgrade instructions provided in the documentation.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for vault.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
