VulnerabilityModified
CVE-2026-4525
If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend.
HIGH 8.8EPSS 0.41%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.41%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.41% probability · 34th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-201
- Affected
- hashicorp/vault
- Source
- security@hashicorp.com
References
- https://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-4525
- https://bugzilla.redhat.com/show_bug.cgi?id=2459107
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4525.json
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.