Is CVE-2026-13303 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13303 being exploited in the wild.

How severe is CVE-2026-13303?

High severity, with a CVSS score of 8.7, published 29 October 2026.

Which products and versions are affected?

HashiCorp Boundary 0.21.3 to 1.0.1; HashiCorp Boundary Enterprise 0.21.3 to 1.0.1.

Is there a fix for CVE-2026-13303?

Yes: fixed in Boundary 0.21.6, Boundary Enterprise 1.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-13303 attacked?

It is attacked over the network.

Am I affected by CVE-2026-13303?

Check whether you run HashiCorp Boundary or HashiCorp Boundary Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13303: HashiCorp Boundary SSRF in Vault credential store integration

CVE-2026-13303 · Severity: high · CVSS 8.7 · Published 2026-10-29

HashiCorp Boundary is a credential broker that integrates with Vault to securely manage access to targets. An authenticated user with permission to manage credential stores and credential libraries can craft a malicious configuration that tricks the Boundary controller into making requests to internal network destinations of the attacker's choosing, potentially exposing sensitive infrastructure endpoints like cloud instance metadata services.

Vendors: HashiCorp.

Quick answers

Is CVE-2026-13303 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13303 being exploited in the wild.
How severe is CVE-2026-13303?: High severity, with a CVSS score of 8.7, published 29 October 2026.
Which products and versions are affected?: HashiCorp Boundary 0.21.3 to 1.0.1; HashiCorp Boundary Enterprise 0.21.3 to 1.0.1.
Is there a fix for CVE-2026-13303?: Yes: fixed in Boundary 0.21.6, Boundary Enterprise 1.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13303 attacked?: It is attacked over the network.
Am I affected by CVE-2026-13303?: Check whether you run HashiCorp Boundary or HashiCorp Boundary Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Boundary 0.21.6, Boundary Enterprise 1.0.2

Technical details

Server-side request forgery (SSRF) in the Vault credential store integration allows authenticated principals with credential-store and credential-library management permissions to manipulate the controller's outbound request destination. The controller failed to sufficiently restrict network destinations when servicing Vault credential requests, allowing an attacker to redirect requests to internal addresses and receive responses containing sensitive information. Exploitation requires authentication and project-scoped credential management permissions; the fix restricts allowable destination addresses.

Affected products

HashiCorp Boundary 0.21.3 to 1.0.1
HashiCorp Boundary Enterprise 0.21.3 to 1.0.1

Timeline

2026-10-29: disclosed

References

https://discuss.hashicorp.com/t/hcsec-2026-54-boundary-vulnerable-to-server-side-request-forgery-in-vault-credential-store/77932

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.