PT-2026-33398 · Hashicorp · Vault

Oleh Konko · Published 2026-04-16 · Updated 2026-04-27 · CVE-2026-4525

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HashiCorp Vault versions prior to 2.0.0 HashiCorp Vault versions prior to 1.21.5 HashiCorp Vault versions prior to 1.20.10 HashiCorp Vault versions prior to 1.19.16

Description When a Vault auth mount is configured to pass through the 'Authorization' header and that same header is used for authentication to Vault, the system forwards the Vault token to the auth plugin backend, leading to token disclosure.

Recommendations Update to version 2.0.0 Update to version 1.21.5 Update to version 1.20.10 Update to version 1.19.16

Fix

Weakness Enumeration

CWE-201

Related Identifiers

BDU:2026-05665

BIT-VAULT-2026-4525

CVE-2026-4525

GHSA-72GW-FMMR-C4R4

Affected Products

Vault

References · 9

• https://bdu.fstec.ru/vul/2026-05665 · Security Note
• https://osv.dev/vulnerability/GHSA-72gw-fmmr-c4r4 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4525 · Security Note
• https://osv.dev/vulnerability/BIT-vault-2026-4525 · Vendor Advisory
• https://github.com/hashicorp/vault · Note
• https://twitter.com/giuseppe_1337/status/2048861063332917541 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2045009686294835603 · Twitter Post
• https://twitter.com/CVEnew/status/2045102617777336463 · Twitter Post