CVE-2026-5052: HashiCorp Vault Server-Side Request Forgery Vulnerability in ACME Challenge Validation
Summary
CVE-2026-5052: Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. Affects github.com/hashicorp/vault versions >= 1.14.0, <= 1.21.4. No fix is published. How to fix ↓
Also tracked for
- vault · Bitnami
The same CVE-2026-5052 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Vault is a widely used open-source tool designed for securely accessing secrets, managing sensitive data, and providing identity-based access management. It supports various secret engines, including PKI for certificate management. The Vault's PKI engine allows users to automate the issuance of certificates through the ACME protocol, which is essential for managing SSL/TLS certificates. However, a recent vulnerability has been identified in the ACME challenge validation process, which could expose local network targets to unauthorized access.
Vulnerability Detail
The vulnerability arises from the ACME validation process in Vault's PKI engine, which fails to reject requests targeting local network addresses during the http-01 and tls-alpn-01 challenges. This oversight allows an attacker to manipulate DNS settings to redirect validation requests to local network resources, potentially leading to information disclosure. The vulnerability is classified under CWE-918, indicating a server-side request forgery risk. The CVSS score for this vulnerability is 5.3, indicating a moderate level of severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the Vault server and ensure that DNS settings are configured to prevent unauthorized redirection of ACME validation requests. Additionally, consider implementing network-level controls to block access to sensitive local resources during the validation process.
Conclusion
In summary, CVE-2026-5052 represents a significant vulnerability in HashiCorp Vault's ACME challenge validation process, which could lead to unauthorized access to local network resources. It is crucial to update to the latest patched versions or implement workarounds to safeguard your application.
See every vulnerability recorded for github.com/hashicorp/vault →
FAQ
CVE-2026-5052 is a vulnerability in HashiCorp Vault that allows server-side request forgery through the ACME challenge validation process.
If your application uses HashiCorp Vault for certificate management, this vulnerability could expose local network resources to unauthorized access.
The vulnerability affects Vault versions from 1.14.0 to 1.21.4. It is fixed in versions 2.0.0 and later, as well as specific earlier versions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, implement network restrictions and monitor DNS settings to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/vault.
