CVE-2026-4525 Hashicorp CVE debrief

Who should care

Hashicorp Vault users and administrators should be aware of this vulnerability and take immediate action to upgrade to a fixed version. Additionally, security teams and vulnerability managers should prioritize this vulnerability due to its high severity and potential impact on sensitive data.

Technical summary

The vulnerability occurs when a Vault auth mount is configured to pass through the 'Authorization' header, and the 'Authorization' header is used to authenticate to Vault. In this case, Vault may forward the Vault token to the auth plugin backend. This could potentially allow unauthorized access to sensitive data. The vulnerability is addressed in Hashicorp Vault versions 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

Defensive priority

High priority should be given to upgrading to a fixed version of Hashicorp Vault. Additionally, defenders should review their current Vault configuration and auth plugin setup to ensure that the 'Authorization' header is not being passed through unnecessarily.

Recommended defensive actions

• Upgrade to a fixed version of Hashicorp Vault (2.0.0, 1.21.5, 1.20.10, or 1.19.16).
• Review and update Vault auth plugin configuration to prevent unnecessary exposure of the 'Authorization' header.
• Monitor Vault logs for potential suspicious activity related to auth plugin interactions.
• Implement additional security controls, such as token blacklisting or restrictive access controls, to mitigate potential impacts.
• Verify and update inventory of affected systems and prioritize patching based on risk and exposure.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, its severity, and affected versions. Additionally, Hashicorp has released a vendor advisory discussing the issue and providing guidance on mitigation.

Official resources