HashiCorp Security Bulletins updates

H

HashiCorp Security Bulletins Security 6d ago

HCSEC-2026-54 - Boundary vulnerable to server-side request forgery in Vault credential store

Bulletin ID: HCSEC-2026-54 Affected Products / Versions: Boundary and Boundary Enterprise 0.21.3 up to 1.0.1; fixed in Boundary Enterprise 1.0.2 and 0.21.6. Publication Date: October 29, 2026 Summary HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage cred…

H

HashiCorp Security Bulletins Security 6d ago

HCSEC-2026-53 - Nomad allocation data migration may allow host directory permission modification via symlink following

Bulletin ID: HCSEC-2026-53 Affected Products / Versions: Nomad and Nomad Enterprise up to 2.0.7; fixed in Nomad 2.1.0 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18. Publication Date: October 29, 2026 Summary HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership…

H

HashiCorp Security Bulletins Security 6d ago

HCSEC-2026-52 - Nomad dispatch payload writes can escape the allocation directory through symlinks

Bulletin ID: HCSEC-2026-52 Affected Products / Versions: Nomad and Nomad Enterprise up to 2.0.7; fixed in Nomad 2.1.0 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18. Publication Date: October 29, 2026 Summary HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allo…

H

HashiCorp Security Bulletins Security 6d ago

HCSEC-2026-51 - Nomad vulnerable to cross-namespace information disclosure in multiple endpoints

Bulletin ID: HCSEC-2026-51 Affected Products / Versions: Nomad and Nomad Enterprise up to 2.0.7; fixed in Nomad 2.1.0 and Nomad Enterprise 2.1.0, 1.11.12, 1.10.18 Publication Date: October 29, 2026 Summary HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read permissions in one…

H

HashiCorp Security Bulletins Security 9d ago

HCSEC-2026-50 - Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules

Bulletin ID: HCSEC-2026-50 Affected Products / Versions: consul-k8s 0.42.0 up to 2.0.4; fixed in consul-k8s 1.8.18 and 2.1.0 Publication Date: October 26, 2026 Summary Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fi…

H

HashiCorp Security Bulletins Security 9d ago

HCSEC-2026-49 - Consul vulnerable to an authorization bypass in health check registration

Bulletin ID: HCSEC-2026-49 Affected Products / Versions: Consul and Consul Enterprise 0.7.2 up to 2.0.4; fixed in Consul 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19 Publication Date: October 26, 2026 Summary HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to anothe…

H

HashiCorp Security Bulletins Security 9d ago

HCSEC-2026-48 - Consul vulnerable to a denial of service in HTTP APIs

Bulletin ID: HCSEC-2026-48 Affected Products / Versions: Consul and Consul Enterprise up to 2.0.4; fixed in Consul 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19 Publication Date: October 26, 2026 Summary HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE…

H

HashiCorp Security Bulletins Security 9d ago

HCSEC-2026-47 - Consul vulnerable to an authorization bypass in service mesh registration

Bulletin ID: HCSEC-2026-47 Affected Products / Versions: Consul 2.0.4 and Consul Enterprise 2.0.4, 1.22.12 and 1.21.18; fixed in Consul 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19 Publication Date: October 26, 2026 Summary HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to app…

H

HashiCorp Security Bulletins Security 9d ago

HCSEC-2026-46 - Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API

Bulletin ID: HCSEC-2026-46 Affected Products / Versions: Consul and Consul Enterprise 1.17.0 up to 2.0.4; fixed in Consul 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19 Publication Date: October 26, 2026 Summary HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent’s service mesh leaf certificate API that may allow an attacker without a val…

H

HashiCorp Security Bulletins Security 22d ago

HCSEC-2026-45 - Updates to HashiCorp subprocessors

Bulletin ID: HCSEC-2026-45 Publication Date: October 13, 2026 Summary As part of HashiCorp’s ongoing commitment to privacy and transparency, we have updated our subprocessors list. These updates include details about the following subprocessors: Entity Description Action Taken Products Affected Shopify Cloud-based commerce platform Removed All Products Zendesk Customer support Removed All Products…

H

HashiCorp Security Bulletins Security 27d ago

HCSEC-2026-44 - Go-getter vulnerable to a path traversal in S3/GCS directory download handling

Bulletin ID: HCSEC-2026-44 Affected Products / Versions: Go-getter up to 1.8.9 and 2.2.4; fixed in go-getter 1.8.10 and 2.2.5 Publication Date: October 8, 2026 Summary HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vu…

H

HashiCorp Security Bulletins Security 28d ago

HCSEC-2026-43 - Vault Inconsistent ACL Policy Evaluation May Allow Bypass of Deny Restrictions

Bulletin ID: HCSEC-2026-43 Affected Products / Versions: Vault Community Edition up to 2.1.1; fixed in Vault Community Edition 2.1.2. Vault Enterprise up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Publication Date: October 7, 2026 Summary Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. Thi…

H

HashiCorp Security Bulletins Security 28d ago

HCSEC-2026-42 - Vault Enterprise ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution

Bulletin ID: HCSEC-2026-42 Affected Products / Versions: Vault Enterprise up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Publication Date: October 7, 2026 Summary Vault’s ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies…

H

HashiCorp Security Bulletins Security 28d ago

HCSEC-2026-41 - Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots

Bulletin ID: HCSEC-2026-41 Affected Products / Versions: Vault Community Edition and Vault Enterprise up to 2.1.1; fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Publication Date: October 7, 2026 Summary Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin direct…

H

HashiCorp Security Bulletins Security 28d ago

HCSEC-2026-40 - Vault PKI ACME Default Directory Policy May Issue Certificates With Unverified Identities

Bulletin ID: HCSEC-2026-40 Affected Products / Versions: Vault Community Edition 1.14.0 up to 2.1.1; fixed in Vault Community Edition 2.1.2. Vault Enterprise 1.14.0 up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Publication Date: October 7, 2026 Summary Vault’s PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate…

H

HashiCorp Security Bulletins Security 1mo ago

HCSEC-2026-39 - Go-getter vulnerable to a privilege escalation issue in its archive decompression handling

Bulletin ID: HCSEC-2026-39 Affected Products / Versions: Go-getter up to 1.8.8 and 2.2.3; fixed in go-getter 1.8.9 and 2.2.4 Publication Date: September 15, 2026 Summary The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permiss…

H

HashiCorp Security Bulletins Security 1mo ago

HCSEC-2026-38 - Consul-template vulnerable to an information disclosure issue in error handling

Bulletin ID: HCSEC-2026-38 Affected Products / Versions: consul-template 0.27.2 through 0.42.1; fixed in consul-template 0.43.0 Publication Date: September 10, 2026 Summary The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad…

H

HashiCorp Security Bulletins Security 1mo ago

HCSEC-2026-37 - Consul vulnerable to an authorization bypass in the Connect service mesh

Bulletin ID: HCSEC-2026-37 Affected Products / Versions: Consul and Consul Enterprise 1.9.0 through 2.0.3; fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4. Publication Date: September 10, 2026 Summary Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not authorized to acce…

H

HashiCorp Security Bulletins Security 1mo ago

HCSEC-2026-36 - Consul vulnerable to an authorization bypass in the catalog deregistration path

Bulletin ID: HCSEC-2026-36 Affected Products / Versions: Consul and Consul Enterprise 1.21.0 through 2.0.3; fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4. Publication Date: September 10, 2026 Summary Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-imported catalog obj…

H

HashiCorp Security Bulletins Security 1mo ago

HCSEC-2026-35 - Consul vulnerable to a denial of service in the native RPC listener

Bulletin ID: HCSEC-2026-35 Affected Products / Versions: Consul and Consul Enterprise 1.21.0 through 2.0.3; fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4. Publication Date: September 10, 2026 Summary Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory before ACL autho…

H

HashiCorp Security Bulletins Security 1mo ago

HCSEC-2026-34 - Consul vulnerable to an authorization bypass in the catalog node-write path

Bulletin ID: HCSEC-2026-34 Affected Products / Versions: Consul and Consul Enterprise up to 2.0.3; fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4. Publication Date: September 10, 2026 Summary Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node’s catalog registr…

H

HashiCorp Security Bulletins Security 1mo ago

HCSEC-2026-33 - HashiCorp Linux Signing GPG Key Update (CA026560)

Bulletin ID: HCSEC-2026-33 Publication Date: September 10, 2026 Summary This bulletin is for informational purposes only. The HashiCorp GPG key used to sign Linux packages was rotated on September 10th, 2026. The new key fingerprint is D55C 0D1A C78A 8D81 26CB 631C FC9C A96A CA02 6560. The new key fingerprint is also available on our Trust Page (https://www.hashicorp.com/en/trust/security). We dee…

H