PT-2026-33406 · Hashicorp+1 · Vault Enterprise+2

Atuin Automated Vulnerability Discovery Engine + 1 · CVE-2026-5807 · Published 2026-04-17 · Updated 2026-06-25

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Vault Community Edition versions prior to 2.0.0 Vault Enterprise versions prior to 2.0.0

Description An unauthenticated attacker can cause a denial-of-service condition by repeatedly initiating or canceling root token generation or rekey operations. This action occupies the single in-progress operation slot, which prevents legitimate operators from completing these specific workflows.

Recommendations Update Vault Community Edition to version 2.0.0. Update Vault Enterprise to version 2.0.0.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2026-08418

BIT-VAULT-2026-5807

CVE-2026-5807

GHSA-88V5-9HXC-F85R

GO-2026-5247

OPENSUSE-SU-2026:10594-1

Affected Products

Red Os

Vault Community Edition

Vault Enterprise

References · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5807.json · Exploit
• https://discuss.hashicorp.com/t/hcsec-2026-08-vault-vulnerable-to-denial-of-service-via-unauthenticated-root-token-generation-rekey-operations/77345 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-88v5-9hxc-f85r · Vendor Advisory
• https://osv.dev/vulnerability/BIT-vault-2026-5807 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5807 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10594-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-5807 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5247 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-08418 · Security Note
• https://github.com/hashicorp/vault · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-vault-cve-2026-5807-7.3 · Note
• https://suse.com/security/cve/CVE-2026-39388 · Note
• https://suse.com/security/cve/CVE-2026-39946 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-vault-cve-2026-5807-8.0 · Note
• https://suse.com/security/cve/CVE-2026-40264 · Note