HashiCorp vulnerabilities

CVEs per yearBy the year they were published

1. 20223
2. 202329
3. 202424
4. 202525
5. 202658

Newest CVEs

• CVE-2026-13303

  Boundary vulnerable to server-side request forgery in Vault credential store

  HashiCorp · Boundary

  High8.7
• CVE-2026-119168

  Nomad allocation data migration may allow host directory permission modification via symlink following

  HashiCorp · Nomad

  High8.8
• CVE-2026-107347

  Nomad dispatch payload writes can escape the allocation directory through symlinks

  HashiCorp · Nomad

  High8.4
• CVE-2026-102260

  Nomad vulnerable to cross-namespace information disclosure in multiple endpoints

  HashiCorp · Nomad

  Medium4.3
• CVE-2026-110720

  Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules

  HashiCorp · Tooling

  Critical9.9
• CVE-2026-115804

  Consul vulnerable to an authorization bypass in health check registration

  HashiCorp · Consul

  Medium6.4
• CVE-2026-105626

  Consul vulnerable to a denial of service in HTTP APIs

  HashiCorp · Consul

  High7.5
• CVE-2026-105608

  Consul vulnerable to an authorization bypass in service mesh registration

  HashiCorp · Consul

  High8.8
• CVE-2026-105765

  Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API

  HashiCorp · Consul

  High7.5
• CVE-2026-19585

  Go-getter vulnerable to a path traversal in S3/GCS directory download handling

  HashiCorp · Shared library

  Medium5.3