Vulnerabilidades em HashiCorp

139 resultados
Análise Vexday

Com 93 CVEs catalogadas e nenhuma registrada no CISA KEV, o perfil de risco ativo da HashiCorp situa-se abaixo da média geral do catálogo, indicando ausência de exploração confirmada em campo até o momento. As 3 vulnerabilidades de severidade crítica e as 10 surgidas nos últimos 90 dias merecem acompanhamento próximo, especialmente CVE-2026-7474, que concentra o maior escore EPSS observado no portfólio (0,0689) e representa o vetor de maior probabilidade de exploração a curto prazo. A falha mais recorrente por tipo é CWE-266 (controle incorreto de privilégios), o que sugere atenção às configurações de permissão e ao modelo de confiança em ambientes que utilizam ferramentas HashiCorp para gestão de credenciais e infraestrutura. A ausência de PoCs públicas conhecidas reduz a superfície de ataque imediata, mas não elimina a necessidade de aplicar correções com regularidade, dado o ritmo recente de novas descobertas.

CVE-2023-25000MEDIUMVault Vulnerable to Cache-Timing Attacks During Seal and Unseal OperationsEPSS 0.2%CVE-2026-19585MEDIUMGo-getter vulnerable to a path traversal in S3/GCS directory download handlingEPSS 0.2%CVE-2026-15970MEDIUML7 intention authorization bypass via custom public listenerEPSS 0.2%CVE-2026-7776HIGHBoundary Workers Vulnerable to Denial of Service During TLS HandshakeEPSS 0.2%CVE-2026-19589HIGHPacker vulnerable to arbitrary file write via crafted plugin archive during installationEPSS 0.2%CVE-2025-13432MEDIUMTerraform Enterprise state versions can be created by users with specific permissions without sufficient write accessEPSS 0.2%CVE-2026-102260MEDIUMNomad vulnerable to cross-namespace information disclosure in multiple endpointsEPSS 0.2%CVE-2026-6959MEDIUMNomad vulnerable to arbitrary file read/write on client host through symlink attackEPSS 0.2%CVE-2024-2877MEDIUMVault Enterprise Leaks Sensitive HTTP Request Headers in the Audit Log When Deployed With a Performance Standby NodeEPSS 0.2%CVE-2026-5061MEDIUMConsul-template vulnerable to sandbox path bypass in file helper via a symlink attackEPSS 0.2%CVE-2026-14978MEDIUMUnicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusionsEPSS 0.1%CVE-2024-10228LOWVagrant VMWare Utility installation files vulnerable to modification by unprivileged userEPSS 0.1%CVE-2026-119168HIGHNomad allocation data migration may allow host directory permission modification via symlink followingEPSS 0.1%CVE-2026-14361MEDIUMConsul-template is vulnerable to path redirection in writeToFile through symlink attackEPSS 0.1%CVE-2026-107347HIGHNomad dispatch payload writes can escape the allocation directory through symlinksEPSS 0.1%CVE-2026-8052MEDIUMNomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attackEPSS 0.1%CVE-2026-88922MEDIUMGo-getter vulnerable to a privilege escalation issue in its archive decompression handlingEPSS 0.1%CVE-2023-2197LOWVault Enterprise Vulnerable to Padding Oracle Attacks When Using a CBC-based Encryption Mechanism with a HSMEPSS 0.1%CVE-2026-105818MEDIUMVault PKI ACME Issues Certificate With Unvalidated SANsEPSS 0.1%