CVE-2026-5052

Published: Apr 17, 2026Modified: Jun 17, 2026

8.6

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 4.0

Source: NVD

Description

Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

Affected (4)

Products: Hashicorp: Vault

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Hashicorp Vault	From 1.14.0 to 2.0.0
Hashicorp Vault	From 1.14.0 to 1.19.16
Hashicorp Vault	From 1.20.0 to 1.20.10
Hashicorp Vault	From 1.21.0 to 1.21.5

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (1)

https://discuss.hashicorp.com/t/hcsec-2026-06-vault-vulnerable-to-server-side-request-forgery-in-acme-challenge-validation-via-attacker-controlled-dns/77343

Source: security@hashicorp.com

Vendor Advisory

Timeline

No history available yet.