Executive brief
HashiCorp Vault, a tool for managing sensitive secrets and credentials, contains a flaw that could accidentally leak authentication tokens to third-party plugins. If a plugin is configured to receive certain network headers, Vault may fail to remove its own security token before forwarding the request, potentially allowing a malicious or compromised plugin to impersonate users. This could lead to unauthorized access to sensitive corporate data or administrative functions.
Technical details
A vulnerability in HashiCorp Vault (CVE-2026-4525) stems from incorrect header sanitization in the request processing logic. When a Vault auth mount is configured with 'passthrough_request_headers' including the 'Authorization' header, and that same header is used for Vault authentication, the service fails to strip the Vault token before forwarding the request to the auth plugin backend. An attacker with low privileges could potentially capture these tokens if they control or can monitor the plugin backend. The vulnerability is mitigated by a fix that explicitly strips the Vault token from forwarded headers regardless of configuration. Patches are available in versions 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
Affected products
- HashiCorp Vault Community Edition 0.11.2 to 1.21.4
- HashiCorp Vault Enterprise 0.11.2 to 1.21.4, 1.20.9, 1.19.15
Timeline
- 2026-04-16: advisory: HashiCorp internal publication date
- 2026-04-17: disclosed: Public disclosure and CVE assignment
- 2026-04-17: patched: Fixed versions released
References
- https://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344
- https://access.redhat.com/security/cve/CVE-2026-4525
- https://bugzilla.redhat.com/show_bug.cgi?id=2459107
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4525.json