CVE-2026-7776: HashiCorp Boundary denial of service in worker node enrollment

CVE-2026-7776 · Severity: high · CVSS 7.5 · Published 2026-05-04

HashiCorp Boundary, a tool used to manage secure access to infrastructure, contains a flaw in how its 'worker' nodes handle new connections. An attacker can intentionally stall the security handshake process, which causes the system to stop processing other legitimate requests. This can lead to a service outage where authorized users and systems are unable to connect to the network resources managed by Boundary.

Technologies: github.com/hashicorp/boundary (Go). Vendors: Go, HashiCorp.

Quick answers

Is CVE-2026-7776 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-7776 being exploited in the wild.
How severe is CVE-2026-7776?
High severity, with a CVSS score of 7.5, published 4 May 2026.
Which products and versions are affected?
github.com/hashicorp/boundary (Go) SEMVER:introduced=0,fixed=0.19.5, SEMVER:introduced=0,fixed=0.19.5,introduced=0.20.0,fixed=0.20.3,introduced=0.21.0,fixed=0.21.3; HashiCorp Boundary < 0.19.5, 0.20.0 to < 0.20.3, 0.21.0 to < 0.21.3; HashiCorp Boundary Enterprise < 0.19.5, 0.20.0 to < 0.20.3, 0.21.0 to < 0.21.3.
Is there a fix for CVE-2026-7776?
Yes. github.com/hashicorp/boundary (Go): upgrade to 0.19.5, 0.21.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-7776 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-7776?
Check whether you run github.com/hashicorp/boundary (Go), HashiCorp Boundary or HashiCorp Boundary Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/hashicorp/boundary (Go): upgrade to 0.19.5, 0.21.3 or later
    go get github.com/hashicorp/boundary@v0.21.3

Technical details

HashiCorp Boundary workers are susceptible to a Denial of Service (DoS) vulnerability (CWE-770) during the node enrollment process. The root cause is a synchronous TLS handshake implementation in the worker authentication listener. An unauthenticated remote attacker can initiate a mutual TLS handshake and then delay or withhold the required client certificate. Because the connection handling path is blocked while waiting for the handshake to complete, the worker becomes unable to accept or route legitimate traffic. This issue is resolved in Boundary versions 0.19.5, 0.20.3, and 0.21.3.

Affected products

  • HashiCorp Boundary < 0.19.5, 0.20.0 to < 0.20.3, 0.21.0 to < 0.21.3
  • HashiCorp Boundary Enterprise < 0.19.5, 0.20.0 to < 0.20.3, 0.21.0 to < 0.21.3

Identifiers

  • CVE-2026-7776
  • GHSA-7x9r-wcgg-w86f
  • GO-2026-5237

Timeline

  • 2026-05-04: disclosed: Initial disclosure by HashiCorp
  • 2026-05-04: patched: Fixes released in versions 0.19.5, 0.20.3, and 0.21.3
  • 2026-05-05: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.