HashiCorp

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

• 9.9CriticalOct 26, 2026HashiCorp Tooling Auth bypass / access controlCVE-2026-110720Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18.
• –UnscoredOct 26, 2026HashiCorpADV-cccs-81d86a681562Serial Number: AV26-1087 Date: October 26, 2026 As of October 26, 2026, HashiCorp is affected by a vulnerability in the following products: Consul Prior to 2.1.0 Consul Enterprise Prior to 1.21.19 Prior to 2.1.0 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. HCSEC-2026-46 - Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API Security - HashiCorp Discuss
• 8.2HighAug 10, 2026HashiCorp Vault Enterprise Auth bypass / access controlCVE-2026-14886Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability (CVE-2026-14886) is fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20.
• 7.7HighJul 6, 2026HashiCorp Terraform Enterprise Path traversal / file handlingCVE-2026-14468HashiCorp Terraform Enterprise contained an issue in its version control system (VCS) ingestion of registry modules that did not correctly enforce the intended boundary on packaged module content. This may allow an authenticated user to include files from outside the intended repository content in a module and then download them, potentially exposing sensitive files readable by the ingestion process. This vulnerability, CVE-2026-14468, is fixed in Terraform Enterprise v2.0.4 and v1.2.4.
• 6.0MediumMay 12, 2026HashiCorp Shared library Path traversal / file handlingCVE-2026-8052HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-8052) is fixed in version 0.1.2 of the exec2 task driver.
• 8.8HighMay 12, 2026HashiCorp Nomad Path traversal / file handlingCVE-2026-7474HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.8.2% likely
• 6.0MediumMay 12, 2026HashiCorp Nomad Path traversal / file handlingCVE-2026-6959HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-6959) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.
• 7.5HighApr 17, 2026Hashicorp vault Information disclosureCVE-2026-4525If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

See every HashiCorp entry on the dashboard.

Top products

• Nomad2 CVEs in the last year
• Vault Enterprise1 CVE in the last year
• vault1 CVE in the last year
• Tooling1 CVE in the last year, 1 critical
• Terraform Enterprise1 CVE in the last year
• Shared library1 CVE in the last year

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• CCCS (Canada) · Oct 26, 2026HashiCorp security advisory (AV26-1087)ADV-cccs-81d86a681562