PT-2026-33400 · Hashicorp · Vault+1

Published 2026-04-17 · Updated 2026-04-17 · CVE-2026-5052

NVD

CVSS v3.1

5.3

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-5052

Affected Products

Vault

Vault Enterprise

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-5052 · Security Note
• https://discuss.hashicorp.com/t/hcsec-2026-06-vault-vulnerable-to-server-side-request-forgery-in-acme-challenge-validation-via-attacker-controlled-dns/77343 · Note