sdk/v0.26.0
2026-09-25T08:52:03Z•c649fefd0fbd8ec78adefd7e30e4e180898e6578aa6bce0e5630db20aaa9516d
CVE-2026-1229CVE-2026-34986CVE-2026-39829CVE-2026-39883ACLAWS authenticationGo vulnerabilitiesHashiCorp VaultSSHauthentication bypassauthorization bypasscryptographydependency vulnerabilitiesidentityrelease notessecurity update
What happened
HashiCorp Vault releases from April through September 2026 contain multiple security fixes across authentication, ACL enforcement, identity, cryptographic libraries, API dependencies, and SSH key handling. Notable issues include AWS authentication bypass risk, ACL and identity authorization bypasses, recovery-token comparison hardening, RSA key-size limits, and updates addressing numerous CVEs, GHSAs, and Go vulnerabilities. Vault v2.1.1 is the latest listed stable release and updates Thrift, x/crypto, and gRPC dependencies.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- hashicorp_vault_releases
- Record identifier
- c649fefd0fbd8ec78adefd7e30e4e180898e6578aa6bce0e5630db20aaa9516d
- Enrichment time
- 2026-09-25T08:52:03Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.