# github.com/hashicorp/vault (Go) vulnerabilities Source: https://junglewise.ai/threats/technologies/github-com-hashicorp-vault Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/github-com-hashicorp-vault.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 55 vulnerabilities in github.com/hashicorp/vault (Go): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-5807, was published on 17 April 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 55 (0 critical, 0 exploited in the wild) ## About github.com/hashicorp/vault (Go) Secrets management and encryption tool for securing access credentials and sensitive data. ## Latest github.com/hashicorp/vault (Go) vulnerabilities - [CVE-2026-5807: HashiCorp Vault denial of service in root token generation and rekeying](https://junglewise.ai/threats/cve-2026-5807-hashicorp-vault-denial-of-service-in-root-token-generation-and) (high, CVSS 7.5, published 17 Apr 2026) - [CVE-2026-5052: HashiCorp Vault SSRF in PKI engine ACME validation](https://junglewise.ai/threats/cve-2026-5052-hashicorp-vault-ssrf-in-pki-engine-acme-validation) (medium, CVSS 5.3, published 17 Apr 2026) - [CVE-2026-4525: HashiCorp Vault token disclosure in auth plugin header forwarding](https://junglewise.ai/threats/cve-2026-4525-hashicorp-vault-token-disclosure-in-auth-plugin-header-forwarding) (high, CVSS 7.5, published 17 Apr 2026) - [CVE-2026-3605: HashiCorp Vault policy bypass in KVv2 secrets engine](https://junglewise.ai/threats/cve-2026-3605-hashicorp-vault-policy-bypass-in-kvv2-secrets-engine) (high, CVSS 8.1, published 17 Apr 2026) - [CVE-2025-12044: Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON](https://junglewise.ai/threats/cve-2025-12044-hashicorp-vault-and-vault-enterprise-vulnerable-to-a-denial-of) (high, CVSS 7.5, published 23 Oct 2025) - [CVE-2025-11621: HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass](https://junglewise.ai/threats/cve-2025-11621-hashicorp-vault-and-vault-enterprise-s-aws-auth-method-may-be) (high, CVSS 8.1, published 23 Oct 2025) - [CVE-2025-6203: GO-2025-3924 - HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads in github.com/hashicorp/vault](https://junglewise.ai/threats/cve-2025-6203-hashicorp-vault-community-edition-denial-of-service-though-complex) (low, CVSS 3.1, published 8 Sep 2025) - [CVE-2025-5999: GO-2025-3837 - Hashicorp Vault has Privilege Escalation Vulnerability in github.com/hashicorp/vault](https://junglewise.ai/threats/cve-2025-5999-hashicorp-vault-has-privilege-escalation-vulnerability) (low, CVSS 3.1, published 11 Aug 2025) - [CVE-2025-6037: GO-2025-3836 - Hashicorp Vault has Incorrect Validation for Non-CA Certificates in github.com/hashicorp/vault](https://junglewise.ai/threats/cve-2025-6037-hashicorp-vault-has-incorrect-validation-for-non-ca-certificates) (low, CVSS 3.1, published 11 Aug 2025) - [CVE-2025-6015: GO-2025-3842 - Hashicorp Vault has Login MFA Rate Limit Bypass Vulnerability in github.com/hashicorp/vault](https://junglewise.ai/threats/cve-2025-6015-hashicorp-vault-has-login-mfa-rate-limit-bypass-vulnerability) (low, CVSS 3.1, published 11 Aug 2025) - [CVE-2025-6004: GO-2025-3840 - Hashicorp Vault has Lockout Feature Authentication Bypass in github.com/hashicorp/vault](https://junglewise.ai/threats/cve-2025-6004-hashicorp-vault-has-lockout-feature-authentication-bypass) (low, CVSS 3.1, published 11 Aug 2025) - [CVE-2025-6014: GO-2025-3841 - Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse in github.com/hashicorp/vault](https://junglewise.ai/threats/cve-2025-6014-hashicorp-vault-s-totp-secrets-engine-susceptible-to-code-reuse) (low, CVSS 3.1, published 11 Aug 2025) - [CVE-2025-6000: GO-2025-3838 - Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration in github.com/hashicorp/vault](https://junglewise.ai/threats/cve-2025-6000-hashicorp-vault-has-code-execution-vulnerability-via-plugin) (low, CVSS 3.1, published 11 Aug 2025) - [CVE-2025-6013: GO-2025-3848 - HashiCorp Vault ldap auth method may not have correctly enforced MFA in github.com/hashicorp/vault](https://junglewise.ai/threats/cve-2025-6013-hashicorp-vault-ldap-auth-method-may-not-have-correctly-enforced) (low, CVSS 3.1, published 11 Aug 2025) - [CVE-2025-6011: GO-2025-3839 - Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing Users in github.com/hashicorp/vault](https://junglewise.ai/threats/cve-2025-6011-hashicorp-vault-has-an-observable-discrepancy-on-existing-and-non) (low, CVSS 3.1, published 11 Aug 2025) - [CVE-2025-4656: Vault Community Edition rekey and recovery key operations can cause denial of service](https://junglewise.ai/threats/cve-2025-4656-vault-community-edition-rekey-and-recovery-key-operations-can) (low, CVSS 3.1, published 28 Jul 2025) - [CVE-2025-4166: Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information](https://junglewise.ai/threats/cve-2025-4166-hashicorp-vault-community-vulnerable-to-generation-of-error) (low, CVSS 3.1, published 6 May 2025) - [CVE-2025-3879: GO-2025-3662 - Hashicorp Vault Community vulnerable to Incorrect Authorization in github.com/hashicorp/vault](https://junglewise.ai/threats/cve-2025-3879-hashicorp-vault-community-vulnerable-to-incorrect-authorization) (low, CVSS 3.1, published 6 May 2025) - [CVE-2024-8185: GO-2024-3246 - Hashicorp Vault vulnerable to denial of service through memory exhaustion in github.com/hashicorp/vault](https://junglewise.ai/threats/cve-2024-8185-hashicorp-vault-vulnerable-to-denial-of-service-through-memory) (low, CVSS 3.1, published 1 Nov 2024) - [CVE-2024-9180: GO-2024-3191 - Vault Community Edition privilege escalation vulnerability in github.com/hashicorp/vault](https://junglewise.ai/threats/cve-2024-9180-vault-community-edition-privilege-escalation-vulnerability) (low, CVSS 3.1, published 11 Oct 2024) - [CVE-2024-7594: GO-2024-3162 - Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default in…](https://junglewise.ai/threats/cve-2024-7594-vault-ssh-secrets-engine-configuration-did-not-restrict-valid) (low, CVSS 3.1, published 9 Oct 2024) - [CVE-2024-8365: GO-2024-3113 - Vault Leaks Client Token and Token Accessor in Audit Devices in github.com/hashicorp/vault](https://junglewise.ai/threats/cve-2024-8365-vault-leaks-client-token-and-token-accessor-in-audit-devices) (low, CVSS 3.1, published 6 Sep 2024) - [CVE-2022-40186: GO-2022-1021 - HashiCorp Vault vulnerable to incorrect metadata access in github.com/hashicorp/vault](https://junglewise.ai/threats/cve-2022-40186-hashicorp-vault-vulnerable-to-incorrect-metadata-access) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2020-16250: Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault](https://junglewise.ai/threats/cve-2020-16250-authentication-bypass-by-spoofing-and-insufficient-verification) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2020-7220: GO-2022-0816 - Improper Resource Shutdown or Release in HashiCorp Vault in github.com/hashicorp/vault](https://junglewise.ai/threats/cve-2020-7220-improper-resource-shutdown-or-release-in-hashicorp-vault) (low, CVSS 3.1, published 21 Aug 2024) ## Most severe github.com/hashicorp/vault (Go) vulnerabilities - [CVE-2026-3605: HashiCorp Vault policy bypass in KVv2 secrets engine](https://junglewise.ai/threats/cve-2026-3605-hashicorp-vault-policy-bypass-in-kvv2-secrets-engine) (high, CVSS 8.1, published 17 Apr 2026) - [CVE-2025-11621: HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass](https://junglewise.ai/threats/cve-2025-11621-hashicorp-vault-and-vault-enterprise-s-aws-auth-method-may-be) (high, CVSS 8.1, published 23 Oct 2025) - [CVE-2026-5807: HashiCorp Vault denial of service in root token generation and rekeying](https://junglewise.ai/threats/cve-2026-5807-hashicorp-vault-denial-of-service-in-root-token-generation-and) (high, CVSS 7.5, published 17 Apr 2026) - [CVE-2026-4525: HashiCorp Vault token disclosure in auth plugin header forwarding](https://junglewise.ai/threats/cve-2026-4525-hashicorp-vault-token-disclosure-in-auth-plugin-header-forwarding) (high, CVSS 7.5, published 17 Apr 2026) - [CVE-2025-12044: Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON](https://junglewise.ai/threats/cve-2025-12044-hashicorp-vault-and-vault-enterprise-vulnerable-to-a-denial-of) (high, CVSS 7.5, published 23 Oct 2025) - [CVE-2026-5052: HashiCorp Vault SSRF in PKI engine ACME validation](https://junglewise.ai/threats/cve-2026-5052-hashicorp-vault-ssrf-in-pki-engine-acme-validation) (medium, CVSS 5.3, published 17 Apr 2026) - [CVE-2020-16251: GO-2024-2488 - HashiCorp Vault Authentication bypass in github.com/hashicorp/vault](https://junglewise.ai/threats/cve-2020-16251-hashicorp-vault-authentication-bypass) (low, CVSS 3.1, published 28 Jun 2024) - [CVE-2020-16250: Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault](https://junglewise.ai/threats/cve-2020-16250-authentication-bypass-by-spoofing-and-insufficient-verification) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2020-7220: GO-2022-0816 - Improper Resource Shutdown or Release in HashiCorp Vault in github.com/hashicorp/vault](https://junglewise.ai/threats/cve-2020-7220-improper-resource-shutdown-or-release-in-hashicorp-vault) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2021-32923: GO-2022-0623 - Invalid session token expiration in github.com/hashicorp/vault](https://junglewise.ai/threats/cve-2021-32923-invalid-session-token-expiration) (low, CVSS 3.1, published 21 Aug 2024) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Go technologies - [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server): 297 vulnerabilities - [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6): 222 vulnerabilities - [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8): 207 vulnerabilities - [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5): 199 vulnerabilities - [stdlib (Go)](https://junglewise.ai/threats/technologies/go-stdlib): 178 vulnerabilities - [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel): 160 vulnerabilities - [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea): 126 vulnerabilities - [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api): 91 vulnerabilities - [gogs.io/gogs (Go)](https://junglewise.ai/threats/technologies/gogs-io-gogs): 81 vulnerabilities - [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2): 78 vulnerabilities - [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik): 75 vulnerabilities - [github.com/usememos/memos (Go)](https://junglewise.ai/threats/technologies/github-com-usememos-memos): 75 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "github.com/hashicorp/vault (Go) vulnerabilities", https://junglewise.ai/threats/technologies/github-com-hashicorp-vault, 13 November 2026.