PT-2026-33400 · Hashicorp · Vault Community Edition+1

Oleh Konko + 1 · Published 2026-04-17 · Updated 2026-04-21 · CVE-2026-5052

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Vault Community Edition versions prior to 2.0.0 HashiCorp Vault Enterprise versions prior to 1.19.16 HashiCorp Vault Enterprise versions 1.19.16 through 1.20.9 HashiCorp Vault Enterprise versions 1.20.10 through 1.21.4 HashiCorp Vault Enterprise versions prior to 1.21.5 HashiCorp Vault Enterprise versions prior to 2.0.0

Description The PKI engine ACME validation fails to reject local targets during the issuance of 'http-01' and 'tls-alpn-01' challenges. This flaw may result in requests being directed to targets within the local network, which could lead to information disclosure.

Recommendations Update HashiCorp Vault Community Edition to version 2.0.0. Update HashiCorp Vault Enterprise to version 1.19.16, 1.20.10, 1.21.5, or 2.0.0.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BIT-VAULT-2026-5052

CVE-2026-5052

GHSA-8R5M-3F66-QPR3

Affected Products

Vault Community Edition

Vault Enterprise

References · 7

• https://osv.dev/vulnerability/GHSA-8r5m-3f66-qpr3 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2026-06-vault-vulnerable-to-server-side-request-forgery-in-acme-challenge-validation-via-attacker-controlled-dns/77343 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-vault-2026-5052 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5052 · Security Note
• https://github.com/hashicorp/vault · Note
• https://twitter.com/VulmonFeeds/status/2045004566639280471 · Twitter Post
• https://twitter.com/CVEnew/status/2045102618859524290 · Twitter Post