HashiCorp Vault vulnerabilities and fixes

CVEs that mention HashiCorp Vault, ranked by priority. 12 tracked.

HashiCorp Vault has 12 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 10. Most recent: 2026-10-22. Highest priority: CVE-2026-62825 (score 63/100).

• CVE-2026-62825 CRITICAL 10.0 MITIGATE Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a networ
• CVE-2026-54725 CRITICAL 9.6 vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible
• CVE-2026-55100 HIGH 8.7 hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API
• CVE-2026-109440 HIGH 8.8 LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers
• CVE-2026-12564 CRITICAL 9.6 A flaw was found in the AAP Controller's HashiCorp Vault credential plugin
• CVE-2026-65709 HIGH 8.3 sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API
• CVE-2026-14886 HIGH 8.2 Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypa
• CVE-2026-68870 MEDIUM 5.3 The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connec
• CVE-2026-114655 MEDIUM 5.9 libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values fro
• CVE-2026-65710 HIGH 7.1 sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users
• CVE-2026-16802 MEDIUM 6.5 UPGRADE Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2
• CVE-2026-115364 LOW 2.2 OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy serv

FAQ

How do I fix HashiCorp Vault vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is HashiCorp Vault being exploited right now?

None of the tracked HashiCorp Vault CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which HashiCorp Vault CVE should I patch first?

CVE-2026-62825 currently ranks highest (63/100): Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a networ.

← Back to latest CVEs