Home

Description

Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

PUBLISHED Reserved 2026-03-27 | Published 2026-04-17 | Updated 2026-04-17 | Assigner HashiCorp




MEDIUM: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Problem types

CWE-918: Server-Side Request Forgery (SSRF)

Product status

Default status
unaffected

1.15.0 (semver) before 2.0.0
affected

Default status
unaffected

1.15.0 (semver) before 2.0.0
affected

References

discuss.hashicorp.com/...n-via-attacker-controlled-dns/77343

cve.org (CVE-2026-5052)

nvd.nist.gov (CVE-2026-5052)

Download JSON