Vulnerabilidades em HashiCorp

139 resultados
Análise Vexday

Com 93 CVEs catalogadas e nenhuma registrada no CISA KEV, o perfil de risco ativo da HashiCorp situa-se abaixo da média geral do catálogo, indicando ausência de exploração confirmada em campo até o momento. As 3 vulnerabilidades de severidade crítica e as 10 surgidas nos últimos 90 dias merecem acompanhamento próximo, especialmente CVE-2026-7474, que concentra o maior escore EPSS observado no portfólio (0,0689) e representa o vetor de maior probabilidade de exploração a curto prazo. A falha mais recorrente por tipo é CWE-266 (controle incorreto de privilégios), o que sugere atenção às configurações de permissão e ao modelo de confiança em ambientes que utilizam ferramentas HashiCorp para gestão de credenciais e infraestrutura. A ausência de PoCs públicas conhecidas reduz a superfície de ataque imediata, mas não elimina a necessidade de aplicar correções com regularidade, dado o ritmo recente de novas descobertas.

CVE-2026-19012MEDIUMAuthenticated denial of service in Consul Enterprise-to-Community Edition downgrade pathEPSS 0.3%CVE-2026-87107MEDIUMConsul vulnerable to an authorization bypass in the catalog deregistration pathEPSS 0.3%CVE-2024-2660MEDIUMVault TLS Cert Auth Method Did Not Correctly Validate OCSP ResponsesEPSS 0.3%CVE-2026-89322HIGHVault ACL Policy Evaluation May Allow Bypass of Deny RestrictionsEPSS 0.3%CVE-2025-3744HIGHNomad Vulnerable To Violation Of Mandatory Sentinel Policies in Nomad Job Submissions via Policy OverrideEPSS 0.3%CVE-2024-1052HIGHBoundary Vulnerable to Session Hijacking Through TLS Certificate TamperingEPSS 0.3%CVE-2026-115804MEDIUMConsul vulnerable to an authorization bypass in health check registrationEPSS 0.3%CVE-2026-5006MEDIUMVault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy PathsEPSS 0.3%CVE-2026-19016MEDIUMAuthorization bypass for session deletion in the transaction APIEPSS 0.3%CVE-2026-12624MEDIUMVault vulnerable to LIST authorization bypass via trailing-slash stripEPSS 0.3%CVE-2025-6037MEDIUMVault Certificate Auth Method Did Not Validate Common Name For Non-CA CertificatesEPSS 0.3%CVE-2024-7594HIGHVault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By DefaultEPSS 0.3%CVE-2023-4782MEDIUMTerraform Allows Arbitrary File Write During Init OperationEPSS 0.3%CVE-2025-4656LOWVault Vulnerable to Recovery Key Cancellation Denial of ServiceEPSS 0.3%CVE-2026-14362MEDIUMDenial of service via crafted push/pull gossip message in memberlistEPSS 0.3%CVE-2026-14896MEDIUMNomad vulnerable to cross-namespace host volume claim deletionEPSS 0.3%CVE-2026-105820MEDIUMVault ACL Policy Cache Vulnerable to Cross-Namespace Policy ResolutionEPSS 0.2%CVE-2026-105765HIGHConsul vulnerable to an authorization bypass in the agent's service mesh leaf certificate APIEPSS 0.2%CVE-2023-5834LOWVagrant’s Windows Installer Allowed Directory Junction WriteEPSS 0.2%CVE-2026-13303HIGHBoundary vulnerable to server-side request forgery in Vault credential storeEPSS 0.2%