HashiCorp Security

HCSEC-2026-22 - Nomad vulnerable to cross-namespace host volume claim deletion

HCSEC-2026-21 - Nomad vulnerable to sandbox escape in Docker task driver

HCSEC-2026-20 - Consul-template vulnerable to path redirections in writeToFile

HCSEC-2026-19 - Nomad Docker driver vulnerable to host namespace bypass on Linux

HCSEC-2026-18 - Memberlist vulnerable to denial of service via gossip message

HCSEC-2026-17 - Terraform Enterprise vulnerable to arbitrary file read

HCSEC-2026-16 - Vault Audit Device Plugin Directory Guard Bypass via Legacy Path Option

HCSEC-2026-15 - Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution

HCSEC-2026-14 - Nomad arbitrary file read/write on client host through symlink attack

HCSEC-2026-13 - Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attack

HCSEC-2026-12 - Consul-template vulnerable to sandbox path bypass in file helper through symlink attack

HCSEC-2026-11 - Boundary Workers Vulnerable to Denial of Service During TLS Handshake

HCSEC-2026-10 - Updates to HashiCorp subprocessors

HCSEC-2026-09 - Remediation and Improved Secret Management for GitHub Webhook Secret Exposure

HCSEC-2026-08 - Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations

HCSEC-2026-07 - Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization

HCSEC-2026-06 - Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS

HCSEC-2026-05 - Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service

HCSEC-2026-04 - Go-getter may allow to arbitrary filesystem reads through git operations

HCSEC-2026-03 - HashiCorp GPG Key (72D7468F) Update

HCSEC-2026-02 - Consul Vulnerable to Arbitrary File Reads Through the Vault Kubernetes Authentication Provider

HCSEC-2026-01 - Arbitrary code execution in React server-side rendering of untrusted MDX content

HCSEC-2025-33 - Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method

HCSEC-2025-34 - Terraform Enterprise state versions can be created by users without sufficient write access

HCSEC-2025-29 - Consul's KV endpoint is vulnerable to denial of service

HCSEC-2025-28 - Consul's event endpoint is vulnerable to denial of service

HCSEC-2025-32 - Incomplete Fix For Previous Vault DoS Issue

HCSEC-2025-31- Vault Vulnerable to Denial of Service Due to Rate Limit Regression

HCSEC-2025-30 - Vault AWS Auth Method Authentication Bypass Through Mishandling of Cache Entries

HCSEC-2025-25 - Updates to HashiCorp subprocessors

HCSEC-2025-24 - Vault Denial of Service Though Complex JSON Payloads

HCSEC-2025-23 - HashiCorp go-getter Vulnerable to Arbitrary Read through Symlink Attack