Skip to content

Commit ac3f426

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-72gw-fmmr-c4r4 GHSA-8r5m-3f66-qpr3 GHSA-m2w4-8ggf-rj47
1 parent 1658312 commit ac3f426

File tree

3 files changed

+88
-13
lines changed

3 files changed

+88
-13
lines changed

advisories/unreviewed/2026/04/GHSA-72gw-fmmr-c4r4/GHSA-72gw-fmmr-c4r4.json renamed to advisories/github-reviewed/2026/04/GHSA-72gw-fmmr-c4r4/GHSA-72gw-fmmr-c4r4.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-72gw-fmmr-c4r4",
4-
"modified": "2026-04-17T06:31:07Z",
4+
"modified": "2026-04-18T00:53:01Z",
55
"published": "2026-04-17T06:31:07Z",
66
"aliases": [
77
"CVE-2026-4525"
88
],
9+
"summary": "HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization",
910
"details": "If a Vault auth mount is configured to pass through the \"Authorization\" header, and the \"Authorization\" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/hashicorp/vault"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0.11.2"
29+
},
30+
{
31+
"last_affected": "1.21.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -22,15 +43,19 @@
2243
{
2344
"type": "WEB",
2445
"url": "https://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/hashicorp/vault"
2550
}
2651
],
2752
"database_specific": {
2853
"cwe_ids": [
2954
"CWE-201"
3055
],
3156
"severity": "HIGH",
32-
"github_reviewed": false,
33-
"github_reviewed_at": null,
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-04-18T00:53:01Z",
3459
"nvd_published_at": "2026-04-17T04:16:09Z"
3560
}
3661
}

advisories/unreviewed/2026/04/GHSA-8r5m-3f66-qpr3/GHSA-8r5m-3f66-qpr3.json renamed to advisories/github-reviewed/2026/04/GHSA-8r5m-3f66-qpr3/GHSA-8r5m-3f66-qpr3.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8r5m-3f66-qpr3",
4-
"modified": "2026-04-17T06:31:07Z",
4+
"modified": "2026-04-18T00:53:25Z",
55
"published": "2026-04-17T06:31:07Z",
66
"aliases": [
77
"CVE-2026-5052"
88
],
9+
"summary": "HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS",
910
"details": "Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/hashicorp/vault"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "1.14.0"
29+
},
30+
{
31+
"last_affected": "1.21.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -22,15 +43,19 @@
2243
{
2344
"type": "WEB",
2445
"url": "https://discuss.hashicorp.com/t/hcsec-2026-06-vault-vulnerable-to-server-side-request-forgery-in-acme-challenge-validation-via-attacker-controlled-dns/77343"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/hashicorp/vault"
2550
}
2651
],
2752
"database_specific": {
2853
"cwe_ids": [
2954
"CWE-918"
3055
],
3156
"severity": "MODERATE",
32-
"github_reviewed": false,
33-
"github_reviewed_at": null,
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-04-18T00:53:25Z",
3459
"nvd_published_at": "2026-04-17T04:16:12Z"
3560
}
3661
}

advisories/unreviewed/2026/04/GHSA-m2w4-8ggf-rj47/GHSA-m2w4-8ggf-rj47.json renamed to advisories/github-reviewed/2026/04/GHSA-m2w4-8ggf-rj47/GHSA-m2w4-8ggf-rj47.json

Lines changed: 30 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-m2w4-8ggf-rj47",
4-
"modified": "2026-04-17T06:31:07Z",
4+
"modified": "2026-04-18T00:51:48Z",
55
"published": "2026-04-17T06:31:07Z",
66
"aliases": [
77
"CVE-2026-3605"
88
],
9-
"details": "An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.",
9+
"summary": "HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service",
10+
"details": "An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/hashicorp/vault"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0.10.0"
29+
},
30+
{
31+
"last_affected": "1.21.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -22,15 +43,19 @@
2243
{
2344
"type": "WEB",
2445
"url": "https://discuss.hashicorp.com/t/hcsec-2026-05-vault-kvv2-metadata-and-secret-deletion-policy-bypass-denial-of-service/77342"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/hashicorp/vault"
2550
}
2651
],
2752
"database_specific": {
2853
"cwe_ids": [
2954
"CWE-288"
3055
],
3156
"severity": "HIGH",
32-
"github_reviewed": false,
33-
"github_reviewed_at": null,
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-04-18T00:51:47Z",
3459
"nvd_published_at": "2026-04-17T04:16:03Z"
3560
}
3661
}

0 commit comments

Comments
 (0)