CVE-2026-92735: HashiCorp Vault credential disclosure in integrated storage join

CVE-2026-92735 · Severity: medium · CVSS 5.9 · Published 2026-11-13

HashiCorp Vault is a secrets management system that stores and controls access to sensitive data like passwords and API keys. An uninitialized Vault node can be tricked by an attacker into sending server environment credentials to an attacker-controlled server during the cluster join process, without requiring authentication. This could expose secrets like cloud provider credentials if they are stored in environment variables.

Technologies: HashiCorp Vault Community Edition, HashiCorp Vault Enterprise. Vendors: HashiCorp.

Quick answers

Is CVE-2026-92735 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-92735 being exploited in the wild.
How severe is CVE-2026-92735?
Medium severity, with a CVSS score of 5.9, published 13 November 2026.
Which products and versions are affected?
HashiCorp Vault Community Edition up to 2.2.1; HashiCorp Vault Enterprise up to 2.2.1; 1.19.x up to 1.19.24; 1.21.x up to 1.21.13.
Is there a fix for CVE-2026-92735?
Yes: fixed in Vault Community Edition 2.2.2; Vault Enterprise 2.2.2, 1.21.14, and 1.19.25. Until then: Restrict network access to the API listener of new Vault nodes until they have joined a cluster. After upgrading, use the retry_join stanza in integrated storage configuration instead of cloud auto-join settings via the API.</anigation> <parameter name="attack_vector">["network"] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92735 attacked?
It is in a hosted service.
Am I affected by CVE-2026-92735?
Check whether you run HashiCorp Vault Community Edition or HashiCorp Vault Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Vault Community Edition 2.2.2; Vault Enterprise 2.2.2, 1.21.14, and 1.19.25

Restrict network access to the API listener of new Vault nodes until they have joined a cluster. After upgrading, use the retry_join stanza in integrated storage configuration instead of cloud auto-join settings via the API.</anigation> <parameter name="attack_vector">["network"]

Technical details

The unauthenticated join API accepts cloud auto-join discovery settings that can redirect credential transmission to attacker-controlled endpoints. When contacting a leader node, Vault forwards VAULT_TOKEN and VAULT_HEADERS environment variables. The vulnerability requires network access to an uninitialized node's API listener but no authentication; initialized nodes and HA-only configurations are unaffected.

Affected products

  • HashiCorp Vault Community Edition up to 2.2.1
  • HashiCorp Vault Enterprise up to 2.2.1; 1.19.x up to 1.19.24; 1.21.x up to 1.21.13

Timeline

  • 2026-11-12: disclosed
  • 2026-11-13: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.