Home

Description

If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

PUBLISHED Reserved 2026-03-20 | Published 2026-04-17 | Updated 2026-04-17 | Assigner HashiCorp




HIGH: 7.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-201: Insertion of Sensitive Information Into Sent Data

Product status

Default status
unaffected

0.11.2 (semver) before 2.0.0
affected

Default status
unaffected

0.11.2 (semver) before 2.0.0
affected

References

discuss.hashicorp.com/...incorrect-header-sanitization/77344

cve.org (CVE-2026-4525)

nvd.nist.gov (CVE-2026-4525)

Download JSON