v2.2.0-rc1
2026-10-08T08:52:05Z•8f123a7a133e623ade3807501027a545096638b09cdcbfb2c05cdc01c63f7436
CVE-2026-1229CVE-2026-34986CVE-2026-39829CVE-2026-39883ACL bypassAWS authenticationGo vulnerabilitiesHashiCorp VaultSSHSSRFauthentication bypasscryptographydependency vulnerabilitiesenterpriseidentity managementprivilege escalationsecurity release
What happened
HashiCorp Vault release feed documents multiple security fixes across versions 2.0.0–2.1.2, including authentication bypass, ACL and privilege-escalation issues, identity boundary enforcement, SSRF protections, cryptographic and dependency vulnerabilities, and an SSH RSA key-size limitation. The most severe item is an authentication-bypass issue in AWS auth, while several releases address authorization-policy bypasses and dependency CVEs. Operators should prioritize upgrading to the latest supported release and review authentication, ACL, identity, and plugin configurations.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- hashicorp_vault_releases
- Record identifier
- 8f123a7a133e623ade3807501027a545096638b09cdcbfb2c05cdc01c63f7436
- Enrichment time
- 2026-10-08T08:52:05Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.