CVE-2026-5051: HashiCorp Vault path traversal in audit device validation

CVE-2026-5051 · Severity: medium · CVSS 4.4 · Published 2026-07-01

HashiCorp Vault is a tool used to manage sensitive secrets and protect data. A vulnerability in its logging system could allow a highly privileged user to bypass security restrictions and write log files into sensitive system directories. This could potentially lead to the corruption of security plugins or unauthorized access to sensitive configuration areas, though it requires high-level administrative access to exploit.

Technologies: HashiCorp Vault, HashiCorp Vault Enterprise. Vendors: HashiCorp.

Quick answers

Is CVE-2026-5051 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-5051 being exploited in the wild.
How severe is CVE-2026-5051?
Medium severity, with a CVSS score of 4.4, published 1 July 2026.
Which products and versions are affected?
HashiCorp Vault 1.20.1 to 2.0.0; fixed in 2.0.1, 1.21.6, 1.20.11; HashiCorp Vault Enterprise 1.19.0 to 2.0.0; fixed in 2.0.1, 1.21.6, 1.20.11, 1.19.17.
Is there a fix for CVE-2026-5051?
A patch was published on 2026-07-01. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5051 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-5051?
Check whether you run HashiCorp Vault or HashiCorp Vault Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in HashiCorp Vault's audit device validation logic. While Vault includes a 'plugin directory guard' to prevent audit logs from being written into sensitive plugin directories, this check only validated the 'file_path' option. The file audit backend also accepted a legacy 'path' option as a fallback, which bypassed this validation. An attacker with high privileges (sufficient to configure audit devices) could exploit this to write audit logs into the plugin directory. This issue is fixed in versions 2.0.1, 1.21.6, 1.20.11, and 1.19.17.

Affected products

  • HashiCorp Vault 1.20.1 to 2.0.0; fixed in 2.0.1, 1.21.6, 1.20.11
  • HashiCorp Vault Enterprise 1.19.0 to 2.0.0; fixed in 2.0.1, 1.21.6, 1.20.11, 1.19.17

Timeline

  • 2026-07-01: disclosed
  • 2026-07-01: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.