PT-2026-33406 · Hashicorp · Vault Enterprise+1

Atuin Automated Vulnerability Discovery Engine + 1 · Published 2026-04-17 · Updated 2026-04-27 · CVE-2026-5807

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Vault Community Edition versions prior to 2.0.0 Vault Enterprise versions prior to 2.0.0

Description An unauthenticated attacker can cause a denial-of-service condition by repeatedly initiating or canceling root token generation or rekey operations. This action occupies the single in-progress operation slot, which prevents legitimate operators from completing these specific workflows.

Recommendations Update Vault Community Edition to version 2.0.0. Update Vault Enterprise to version 2.0.0.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BIT-VAULT-2026-5807

CVE-2026-5807

GHSA-88V5-9HXC-F85R

OPENSUSE-SU-2026:10594-1

Affected Products

Vault Community Edition

Vault Enterprise

References · 15

• https://discuss.hashicorp.com/t/hcsec-2026-08-vault-vulnerable-to-denial-of-service-via-unauthenticated-root-token-generation-rekey-operations/77345 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-88v5-9hxc-f85r · Vendor Advisory
• https://osv.dev/vulnerability/BIT-vault-2026-5807 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10594-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5807 · Security Note
• https://github.com/hashicorp/vault · Note
• https://suse.com/security/cve/CVE-2026-39946 · Note
• https://suse.com/security/cve/CVE-2026-39388 · Note
• https://twitter.com/VulmonFeeds/status/2045076273718874367 · Twitter Post
• https://suse.com/security/cve/CVE-2026-39396 · Note
• https://suse.com/security/cve/CVE-2026-5807 · Note
• https://twitter.com/giuseppe_1337/status/2048866117641212007 · Twitter Post
• https://twitter.com/CVEnew/status/2045102616770703558 · Twitter Post
• https://suse.com/security/cve/CVE-2026-3605 · Note
• https://suse.com/security/cve/CVE-2026-40264 · Note