HashiCorp — Security Activity Report

Terraform, Vault, Consul, Nomad

Generated Jul 22, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗

CVE Disclosure Volume

Total all-time: 26 CVEs with HashiCorp advisories. Source: NVD CVE records joined with vendor advisory publish dates.

Severity Composition

↑ +5.5 pp

57.7% of HashiCorp's 26 CVEs are CRITICAL or HIGH severity. Industry median: 52.2%. Source: NVD CVSS v3.1.

HIGH 15 (57.7%)MEDIUM 11 (42.3%)

CISA KEV Listings

↓ -1.0 pp

0 of 26 HashiCorp CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (0.0%). Industry median: 1.0%.

Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.

Vendor Patch Velocity

Insufficient data to publish a reliable patch-velocity metric for HashiCorp(sample size: 1, minimum required: 10).

Top Recurring Weakness Classes

Most-frequently mapped CWEs across HashiCorp's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.

CWE-770Allocation of Resources Without Limits or Throttling7 CVEs
CWE-59Improper Link Resolution Before File Access (Link Following)6 CVEs
CWE-22Path Traversal4 CVEs
CWE-288Authentication Bypass Using an Alternate Path or Channel2 CVEs
CWE-863Incorrect Authorization2 CVEs

Recent Security Advisories

Latest advisories published by HashiCorp, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.

HCSEC-2026-22
Jul 8, 2026
HCSEC-2026-22 - Nomad vulnerable to cross-namespace host volume claim deletion
CVE-2026-14896 vendor source ↗
HCSEC-2026-21
Jul 8, 2026
HCSEC-2026-21 - Nomad vulnerable to sandbox escape in Docker task driver
CVE-2026-14891 vendor source ↗
HCSEC-2026-20
Jul 8, 2026
HCSEC-2026-20 - Consul-template vulnerable to path redirections in writeToFile
CVE-2026-14361 vendor source ↗
HCSEC-2026-19
Jul 8, 2026
HCSEC-2026-19 - Nomad Docker driver vulnerable to host namespace bypass on Linux
CVE-2026-14373 vendor source ↗
HCSEC-2026-18
Jul 8, 2026
HCSEC-2026-18 - Memberlist vulnerable to denial of service via gossip message
CVE-2026-14362 vendor source ↗
HCSEC-2026-17
Jul 6, 2026
HCSEC-2026-17 - Terraform Enterprise vulnerable to arbitrary file read
CVE-2026-14468 vendor source ↗
HCSEC-2026-16
Jul 1, 2026
HCSEC-2026-16 - Vault Audit Device Plugin Directory Guard Bypass via Legacy Path Option
CVE-2026-5051 vendor source ↗
HCSEC-2026-15
May 12, 2026
HCSEC-2026-15 - Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution
CVE-2026-7474 vendor source ↗

Full advisory archive: /pulse/vendor-advisories →

Data sources & corrections

NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
Vendor security advisories (RHSA, USN, MSRC, GHSA, etc.) — published_at timestamps
MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings

Snapshot generated Jul 22, 2026. Industry medians refresh every 6 hours; raw vendor counts are queried live on each request.

Spot a factual error in this report?

Email support@echelongraph.io with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.