HashiCorp — Security Activity Report

Terraform, Vault, Consul, Nomad

Generated Nov 2, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗

CVE Disclosure Volume

Total all-time: 66 CVEs with HashiCorp advisories. Source: NVD CVE records joined with vendor advisory publish dates.

Severity Composition

↑ +2.2 pp

56.1% of HashiCorp's 66 CVEs are CRITICAL or HIGH severity. Industry median: 53.8%. Source: NVD CVSS v3.1.

CRITICAL 5 (7.6%)HIGH 32 (48.5%)MEDIUM 29 (43.9%)

CISA KEV Listings

↓ -0.6 pp

0 of 66 HashiCorp CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (0.0%). Industry median: 0.6%.

Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.

Vendor Patch Velocity

Insufficient data to publish a reliable patch-velocity metric for HashiCorp(sample size: 3, minimum required: 10).

Top Recurring Weakness Classes

Most-frequently mapped CWEs across HashiCorp's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.

CWE-770Allocation of Resources Without Limits or Throttling11 CVEs
CWE-22Path Traversal9 CVEs
CWE-59Improper Link Resolution Before File Access (Link Following)9 CVEs
CWE-863Incorrect Authorization7 CVEs
CWE-862Missing Authorization4 CVEs

Recent Security Advisories

Latest advisories published by HashiCorp, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.

HCSEC-2026-54
Oct 29, 2026
HCSEC-2026-54 - Boundary vulnerable to server-side request forgery in Vault credential store
CVE-2026-13303 vendor source ↗
HCSEC-2026-53
Oct 29, 2026
HCSEC-2026-53 - Nomad allocation data migration may allow host directory permission modification via symlink following
CVE-2026-119168 vendor source ↗
HCSEC-2026-52
Oct 29, 2026
HCSEC-2026-52 - Nomad dispatch payload writes can escape the allocation directory through symlinks
CVE-2026-107347 vendor source ↗
HCSEC-2026-51
Oct 29, 2026
HCSEC-2026-51 - Nomad vulnerable to cross-namespace information disclosure in multiple endpoints
CVE-2026-102260 vendor source ↗
HCSEC-2026-50
Oct 26, 2026
HCSEC-2026-50 - Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules
CVE-2026-110720 vendor source ↗
HCSEC-2026-49
Oct 26, 2026
HCSEC-2026-49 - Consul vulnerable to an authorization bypass in health check registration
CVE-2026-115804 vendor source ↗
HCSEC-2026-48
Oct 26, 2026
HCSEC-2026-48 - Consul vulnerable to a denial of service in HTTP APIs
CVE-2026-105626 vendor source ↗
HCSEC-2026-47
Oct 26, 2026
HCSEC-2026-47 - Consul vulnerable to an authorization bypass in service mesh registration
CVE-2026-105608 vendor source ↗

Full advisory archive: /pulse/vendor-advisories →

Data sources & corrections

NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
Vendor security advisories (Red Hat RHSA, Ubuntu USN, Microsoft MSRC, Cisco PSIRT and other per-vendor feeds; the GitHub and OSV advisory databases are not used) — published_at timestamps
MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings

Snapshot generated Nov 2, 2026: when these counts and industry medians were computed. Vendors in the index are recomputed every 6 hours.

Spot a factual error in this report?

Email support@echelongraph.io with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.