Executive brief
HashiCorp Vault, a tool used for managing sensitive secrets and encryption keys, is vulnerable to a denial-of-service attack. An unauthorized person can repeatedly start or cancel critical administrative tasks, such as generating root tokens or rotating security keys. This blocks legitimate administrators from performing these essential security operations, potentially preventing system recovery or emergency access during a crisis.
Technical details
HashiCorp Vault is vulnerable to a Denial of Service (DoS) via resource exhaustion (CWE-770). The vulnerability exists in the 'sys/rekey', 'sys/generate-root', and 'sys/rekey-recovery-key' HTTP endpoints, which were previously unauthenticated. Because Vault only allows a single in-progress operation for these workflows, a remote, unauthenticated attacker can repeatedly initiate or cancel these processes to occupy the operation slot indefinitely. This prevents legitimate operators from completing root token generation or key rotation. The issue is resolved in Vault 2.0.0 by requiring authentication for these endpoints.
Affected products
- HashiCorp Vault Community Edition <= 1.21.4
- HashiCorp Vault Enterprise <= 1.21.4, 1.20.9, 1.19.15
Timeline
- 2026-04-16: disclosed: Initial publication by HashiCorp
- 2026-04-17: advisory: GitHub and NVD advisories published
- 2026-04-17: patched: Fixed in version 2.0.0
References
- https://discuss.hashicorp.com/t/hcsec-2026-08-vault-vulnerable-to-denial-of-service-via-unauthenticated-root-token-generation-rekey-operations/77345
- https://access.redhat.com/security/cve/CVE-2026-5807
- https://bugzilla.redhat.com/show_bug.cgi?id=2459109
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5807.json