Known Vulnerabilities for products from HashiCorp
Listed below are 20 of the newest known vulnerabilities associated with the vendor "HashiCorp".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-97636 json | Not Provided | 2026-09-24 | 2026-09-25 | |
| CVE-2026-94416 json | Not Provided | 2026-09-24 | 2026-10-21 | |
| CVE-2026-55102 json | Not Provided | 2026-09-14 | 2026-09-14 | |
| CVE-2026-55100 json | Not Provided | 2026-07-31 | 2026-07-31 | |
| CVE-2026-54629 json | Not Provided | 2026-09-14 | 2026-09-15 | |
| CVE-2026-19585 json | Not Provided | 2026-10-08 | 2026-10-08 | |
| CVE-2026-15911 json | Not Provided | 2026-10-01 | 2026-10-06 | |
| CVE-2026-14978 json | HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive... | Not Provided | 2026-08-19 | 2026-09-04 |
| CVE-2026-12564 json | Not Provided | 2026-08-18 | 2026-09-24 | |
| CVE-2026-5807 json | Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root... | Not Provided | 2026-04-17 | 2026-07-15 |
| CVE-2026-5052 json | Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This m... | Not Provided | 2026-04-17 | 2026-04-27 |
| CVE-2026-5006 json | Not Provided | 2026-08-24 | 2026-08-26 | |
| CVE-2026-4525 json | If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to aut... | Not Provided | 2026-04-17 | 2026-07-15 |
| CVE-2026-3605 json | An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were n... | Not Provided | 2026-04-17 | 2026-07-15 |
| CVE-2025-13432 json | Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise worksp... | Not Provided | 2025-11-21 | 2026-10-08 |
| CVE-2025-13357 json | Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by defaul... | Not Provided | 2025-11-21 | 2026-10-08 |
| CVE-2025-12044 json | Vault and Vault Enterprise (“Vault”) are vulnerable to an unauthenticated denial of service when processing JSON payloads... | Not Provided | 2025-10-23 | 2026-06-17 |
| CVE-2025-11621 json | Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the c... | Not Provided | 2025-10-23 | 2026-06-17 |
| CVE-2025-11375 json | Consul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack of maximu... | Not Provided | 2025-10-28 | 2026-06-17 |
| CVE-2025-11374 json | Consul and Consul Enterprise’s (“Consul”) key/value endpoint is vulnerable to denial of service (DoS) due to incorrect ... | Not Provided | 2025-10-28 | 2026-06-17 |
Known software with vulnerabilities from HashiCorp
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Hashicorp | Boundary | 0.1.0 |
| Application | Hashicorp | Consul | 0.1.0 |
| Application | Hashicorp | Consul Docker Image | 0.6.4 |
| Application | Hashicorp | Go-slug | 0.1.0 |
| Application | Hashicorp | Nomad | 0.0.0 |
| Application | Hashicorp | Packer | 0.1.0 |
| Application | Hashicorp | Sentinel | 0.1.0 |
| Application | Hashicorp | Terraform | 0.1.0 |
| Application | Hashicorp | Terraform Enterprise | 202007-1 |
| Application | Hashicorp | Vagrant | 5.0.1 |
| Application | Hashicorp | Vagrant Vmware Fusion | 2.3.5 |
| Application | Hashicorp | Vault | 0.1.0 |
| Application | Hashicorp | Vault-ssh-helper | - |
| Application | Hashicorp | Waypoint | 0.0.1 |