CVE-2026-105816 HashiCorp CVE debrief

Who should care

Vault operators, administrators, and security teams should assess exposure and apply patches to prevent potential arbitrary code execution. They should also verify configurations of external plugin directories and monitor for suspicious activity related to plugin catalog entries. Additionally, security teams should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-105816 allows a privileged operator to execute arbitrary code on the Vault host via plugin catalog entries restored from Raft snapshots. Defenders should assess exposure, verify configurations, and apply patches to prevent potential code execution and disruption.

• Potential arbitrary code execution on Vault host
• Exposure of Vault instances to Raft snapshot restoration
• Need for patching and configuration verification
• Potential disruption to Vault services

Technical summary

HashiCorp Vault and Vault Enterprise did not consistently verify stored plugin catalog entries reference binaries within the configured plugin directory. A privileged operator able to restore an Integrated Storage (Raft) snapshot may execute arbitrary code on the Vault host when Vault uses Shamir seals and has an external plugin directory configured. This vulnerability allows potential arbitrary code execution on the Vault host via plugin catalog entries restored from Raft snapshots. Defenders should assess exposure, verify configurations, and apply patches to prevent potential code execution and disruption.

Defensive priority

High priority for Vault operators and administrators to assess exposure and apply patches

Recommended defensive actions

• Assess exposure of Vault instances to Raft snapshot restoration
• Verify configuration of external plugin directories
• Apply patches to Vault Community Edition and Enterprise versions
• Monitor for suspicious activity related to plugin catalog entries
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Official CVE Program record and NIST NVD detail page confirm vulnerability in HashiCorp Vault and Vault Enterprise. Vendor advisory discusses arbitrary code execution via plugin catalog entries restored from Raft snapshots.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.