CVE-2026-5052 Hashicorp CVE debrief

Who should care

Defenders responsible for Vault deployments, especially those using versions prior to 2.0.0, 1.21.5, 1.20.10, and 1.19.16, should assess exposure and potential impact. This includes operators managing Vault instances, security teams reviewing vulnerability management, and platform administrators ensuring system integrity.

Why it matters

CVE-2026-5052 is a vulnerability in Hashicorp Vault's PKI engine's ACME validation that may lead to information disclosure. Defenders should verify exposure, assess network impact, and apply patches or updates to affected versions.

• Potential information disclosure due to requests being sent to local network targets
• Verification of Vault version and network exposure is necessary
• Patching or updating affected Vault versions is recommended

Technical summary

The vulnerability in Hashicorp Vault's PKI engine's ACME validation could lead to information disclosure when issuing http-01 and tls-alpn-01 challenges. The issue arises because the validation does not reject local targets, allowing potential attackers to send requests to local network targets. This could result in unauthorized access to sensitive information within the local network. The vulnerability is fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16. Defenders should prioritize verifying exposure in Vault deployments, especially those using versions prior to these fixed versions.

Defensive priority

Defenders should prioritize verifying exposure in Vault deployments, especially those using versions prior to 2.0.0, 1.21.5, 1.20.10, and 1.19.16, and assess the network impact of potential information disclosure.

Recommended defensive actions

• Verify Vault version and check if it's within the vulnerable range
• Assess network exposure and potential impact of information disclosure
• Apply patches or updates to affected Vault versions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Hashicorp Vault's PKI engine. Vendor advisory is available from Hashicorp. The issue is fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16. Defenders should verify exposure by checking Vault versions and network configurations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.