{"id":"CVE-2026-105816","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-105816","generatedAt":"2026-10-28T10:47:58.043Z","title":"When Vault uses Shamir seals and has an external plugin directory configured, a privileged operator able to restore an Integrated Storage (Raft) snapshot may be able to execute arbitrary code on the Vault host.","description":"Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory configured, a privileged operator able to restore an Integrated Storage (Raft) snapshot may be able to execute arbitrary code on the Vault host. This vulnerability (CVE-2026-105816) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.","published":"2026-10-07T22:17:03.000Z","lastModified":"2026-10-09T04:18:05.000Z","status":"Awaiting Analysis","sourceIdentifier":"security@hashicorp.com","cvss":{"version":"3.1","score":8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"},"cwe":["CWE-22"],"affected":[],"epss":{"score":0.00335,"percentile":0.2667,"date":"2026-10-27","history":[{"date":"2026-10-08","score":0.00335,"percentile":0.24785}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.34%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-07T22:17:03.000Z","detail":{"score":"8.0","severity":"HIGH","publishedAt":"2026-10-07T22:17:02.673Z"},"summary":"New CVE, high severity (CVSS 8.0)."}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-41-vault-vulnerable-to-arbitrary-code-execution-via-plugin-catalog-entries-restored-from-raft-snapshots/77813","source":"security@hashicorp.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-105816","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}