github.com/hashicorp/vault vulnerabilities — 112 matching vulnerabilities

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed — no installation and no source-code access required.

Scan your app free →
Severity Vulnerability Package Ecosystem Disclosed Fixed version
Unrated CVE-2026-3605: HashiCorp Vault KVv2 Metadata and Secret Deletion Policy Bypass Leading to Denial-of-Service github.com/hashicorp/vault Go 25 Jun 2026 No fix published
Unrated CVE-2026-4525: HashiCorp Vault Token Exposure Due to Header Sanitization Flaw github.com/hashicorp/vault Go 25 Jun 2026 No fix published
Unrated CVE-2026-5052: HashiCorp Vault Server-Side Request Forgery Vulnerability in ACME Challenge Validation github.com/hashicorp/vault Go 25 Jun 2026 No fix published
Unrated CVE-2026-5807: HashiCorp Vault Denial-of-Service Vulnerability via Unauthenticated Root Token Operations github.com/hashicorp/vault Go 25 Jun 2026 No fix published
7.5 high CVE-2026-5807: HashiCorp Vault Denial-of-Service via Unauthenticated Root Token Operations github.com/hashicorp/vault Go 17 Apr 2026 No fix published
8.1 high CVE-2026-3605: HashiCorp Vault KVv2 Metadata and Secret Deletion Policy Bypass Vulnerability github.com/hashicorp/vault Go 17 Apr 2026 No fix published
5.3 medium CVE-2026-5052: HashiCorp Vault Server-Side Request Forgery Vulnerability in ACME Challenge Validation github.com/hashicorp/vault Go 17 Apr 2026 No fix published
7.5 high CVE-2026-4525: HashiCorp Vault Token Exposure Due to Header Sanitization Flaw github.com/hashicorp/vault Go 17 Apr 2026 No fix published
Unrated CVE-2025-12044: Hashicorp Vault Denial of Service Vulnerability github.com/hashicorp/vault Go 30 Oct 2025 1.21.0
Unrated CVE-2025-11621: HashiCorp Vault AWS Auth Method Authentication Bypass Vulnerability github.com/hashicorp/vault Go 30 Oct 2025 1.21.0
7.5 high CVE-2025-12044: Hashicorp Vault Denial of Service Vulnerability in JSON Processing github.com/hashicorp/vault Go 23 Oct 2025 1.21.0
8.1 high CVE-2025-11621: HashiCorp Vault AWS Auth Method Authentication Bypass Vulnerability github.com/hashicorp/vault Go 23 Oct 2025 1.21.0
Unrated CVE-2025-6203: Denial of Service Vulnerability in HashiCorp Vault Due to Complex JSON Payloads github.com/hashicorp/vault Go 08 Sep 2025 1.20.3
7.5 high CVE-2025-6203: HashiCorp Vault Denial of Service via Complex JSON Payloads github.com/hashicorp/vault Go 28 Aug 2025 1.20.3
Unrated CVE-2025-6004: Hashicorp Vault Lockout Feature Authentication Bypass Vulnerability github.com/hashicorp/vault Go 11 Aug 2025 1.20.1
Unrated CVE-2025-6014: Hashicorp Vault TOTP Secrets Engine Code Reuse Vulnerability github.com/hashicorp/vault Go 11 Aug 2025 1.20.1
Unrated CVE-2025-6011: Hashicorp Vault Observable Discrepancy in User Verification github.com/hashicorp/vault Go 11 Aug 2025 1.20.1
Unrated CVE-2025-6015: Hashicorp Vault Login MFA Rate Limit Bypass Vulnerability github.com/hashicorp/vault Go 11 Aug 2025 1.20.1
Unrated CVE-2025-6037: Hashicorp Vault - Incorrect Validation for Non-CA Certificates github.com/hashicorp/vault Go 11 Aug 2025 1.20.1
Unrated CVE-2025-5999: Privilege Escalation Vulnerability in Hashicorp Vault github.com/hashicorp/vault Go 11 Aug 2025 1.20.0
Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

Searching the database

How do I search for a CVE or a package?

Type a CVE id, package name, ecosystem or keyword into the search field. Results include the severity, the affected package, the ecosystem, the disclosure date and the fixed version.

Can I filter by severity or by whether a fix exists?

Yes. The filters on the left narrow the list to critical, high, medium or low vulnerabilities, to a single ecosystem, and to vulnerabilities that have a fix available or none yet.

What does "No fix published" mean?

No patched version has been released for that vulnerability yet. The vulnerability page still shows the affected range and any workaround that can reduce exposure in the meantime.