Executive brief
HashiCorp Vault, a tool for managing sensitive secrets and certificates, contains a flaw in how it validates requests during automated certificate issuance. An attacker could potentially trick the system into sending requests to internal network services that should not be accessible from the outside. This could lead to the exposure of sensitive internal information or details about the private network infrastructure.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the HashiCorp Vault PKI engine's ACME implementation. The root cause is a failure to reject local or internal network targets when performing http-01 and tls-alpn-01 challenge validations. By controlling DNS responses for a domain undergoing ACME validation, a remote attacker can redirect Vault's validation requests to internal IP addresses. Depending on configuration, the challenge endpoint may be unauthenticated or require an External Account Binding (EAB) token. This can result in unauthorized information disclosure from internal services. The issue is fixed in Vault Community Edition 2.0.0 and Vault Enterprise versions 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
Affected products
- HashiCorp Vault Community Edition 1.14.0 to 1.21.4
- HashiCorp Vault Enterprise 1.14.0 to 1.21.4, 1.20.9, 1.19.15
Timeline
- 2026-04-16: disclosed: Initial publication date by HashiCorp
- 2026-04-17: advisory: GitHub and NVD advisory publication
- 2026-04-17: patched: Fixes released in multiple versions