CVE-2026-5051

Audit Log Plugin Directory Guard Bypass via Legacy path Option

CVSS 4.4 MEDIUMEPSS 0.3%CWE-22

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 4.4EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

01 jul 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used. This vulnerability (CVE-2026-5051) is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17.

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Produtos afetados

HashiCorp · Vault HashiCorp · Vault Enterprise

Referências

https://discuss.hashicorp.com/t/hcsec-2026-16-vault-audit-device-plugin-directory-guard-bypass-via-legacy-path-option/77536