# HashiCorp vulnerabilities Source: https://junglewise.ai/threats/vendors/hashicorp Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/hashicorp.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 46 vulnerabilities in HashiCorp: 2 in the last 7 days and 18 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-93335, was published on 13 November 2026. 9 vulnerabilities in the last four weeks, up 800% on the four before (1). 1 critical against 0. 8 technologies have a page of their own. ## Counts - Last 7 days: 2 - Last 30 days: 11 - Last 90 days: 18 - All time: 46 (3 critical, 0 exploited in the wild) ## About HashiCorp A software company that provides open-source tools and commercial products for cloud infrastructure automation and management. ## Latest HashiCorp vulnerabilities - [CVE-2026-93335: HashiCorp Vault ACL policy deny bypass via trailing slash](https://junglewise.ai/threats/cve-2026-93335-vault-community-edition-and-vault-enterprise-did-not-consistently) (medium, CVSS 6.5, published 13 Nov 2026) - [CVE-2026-92735: HashiCorp Vault credential disclosure in integrated storage join](https://junglewise.ai/threats/cve-2026-92735-hashicorp-vault-and-vault-enterprise-are-vulnerable-to-an-issue) (medium, CVSS 5.9, published 13 Nov 2026) - [CVE-2026-13303: HashiCorp Boundary SSRF in Vault credential store integration](https://junglewise.ai/threats/cve-2026-13303-hashicorp-boundary-and-boundary-enterprise-are-vulnerable-to-a) (high, CVSS 8.7, published 29 Oct 2026) - [CVE-2026-119168: HashiCorp Nomad symlink following in allocation data migration](https://junglewise.ai/threats/cve-2026-119168-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-symlink) (high, CVSS 8.8, published 29 Oct 2026) - [CVE-2026-107347: HashiCorp Nomad symlink following in dispatch payload and executor logs](https://junglewise.ai/threats/cve-2026-107347-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-symlink) (high, CVSS 8.4, published 29 Oct 2026) - [CVE-2026-102260: HashiCorp Nomad cross-namespace authorization bypass in API endpoints](https://junglewise.ai/threats/cve-2026-102260-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-cross) (medium, CVSS 4.3, published 29 Oct 2026) - [CVE-2026-110720: HashiCorp Consul-k8s authorization bypass in ACL binding rules](https://junglewise.ai/threats/cve-2026-110720-consul-k8s-versions-0-42-0-and-later-are-vulnerable-to-a-cross) (critical, CVSS 9.9, published 26 Oct 2026) - [CVE-2026-115804: HashiCorp Consul authorization bypass in health check registration](https://junglewise.ai/threats/cve-2026-115804-hashicorp-consul-and-consul-enterprise-are-vulnerable-to-an) (medium, CVSS 6.4, published 26 Oct 2026) - [CVE-2026-105765: HashiCorp Consul authorization bypass in service mesh leaf certificate API](https://junglewise.ai/threats/cve-2026-105765-hashicorp-consul-and-consul-enterprise-1-17-0-up-to-2-0-4-are) (high, CVSS 7.5, published 26 Oct 2026) - [CVE-2026-105626: HashiCorp Consul HTTP API denial of service](https://junglewise.ai/threats/cve-2026-105626-hashicorp-consul-and-consul-enterprise-are-vulnerable-to-a) (high, CVSS 7.5, published 26 Oct 2026) - [CVE-2026-105608: HashiCorp Consul authorization bypass in service mesh proxy registration](https://junglewise.ai/threats/cve-2026-105608-hashicorp-consul-and-consul-enterprise-are-vulnerable-to-an) (high, CVSS 8.8, published 26 Oct 2026) - [CVE-2026-88922: go-getter privilege escalation in archive decompression](https://junglewise.ai/threats/cve-2026-88922-go-getter-privilege-escalation-in-archive-decompression) (medium, CVSS 6.7, published 15 Sep 2026) - [CVE-2026-88021: HashiCorp Consul authorization bypass in Connect service mesh](https://junglewise.ai/threats/cve-2026-88021-hashicorp-consul-authorization-bypass-in-connect-service-mesh) (high, CVSS 7.1, published 10 Sep 2026) - [CVE-2026-87993: HashiCorp Consul-template information disclosure in error handling](https://junglewise.ai/threats/cve-2026-87993-hashicorp-consul-template-information-disclosure-in-error) (high, CVSS 7.7, published 10 Sep 2026) - [CVE-2026-87107: HashiCorp Consul authorization bypass in catalog deregistration](https://junglewise.ai/threats/cve-2026-87107-hashicorp-consul-authorization-bypass-in-catalog-deregistration) (medium, CVSS 5.4, published 10 Sep 2026) - [CVE-2026-87106: HashiCorp Consul denial of service in native RPC listener](https://junglewise.ai/threats/cve-2026-87106-hashicorp-consul-denial-of-service-in-native-rpc-listener) (medium, CVSS 6.5, published 10 Sep 2026) - [CVE-2026-87090: HashiCorp Consul authorization bypass in catalog node-write](https://junglewise.ai/threats/cve-2026-87090-hashicorp-consul-authorization-bypass-in-catalog-node-write) (high, CVSS 8.3, published 10 Sep 2026) - [CVE-2026-5006: HashiCorp Vault privilege escalation in templated policy paths](https://junglewise.ai/threats/cve-2026-5006-hashicorp-vault-privilege-escalation-in-templated-policy-paths) (medium, CVSS 6.8, published 24 Aug 2026) - [CVE-2026-12624: HashiCorp Vault ACL policy engine authorization bypass in LIST requests](https://junglewise.ai/threats/cve-2026-12624-hashicorp-vault-acl-policy-engine-authorization-bypass-in-list) (medium, CVSS 4.3, published 10 Aug 2026) - [CVE-2026-16328: HashiCorp consul-mcp-server SSRF and token exfiltration](https://junglewise.ai/threats/cve-2026-16328-hashicorp-consul-mcp-server-ssrf-and-token-exfiltration) (high, CVSS 8.6, published 29 Jul 2026) - [CVE-2026-16326: HashiCorp consul-mcp-server session state leakage in stateless mode](https://junglewise.ai/threats/cve-2026-16326-hashicorp-consul-mcp-server-session-state-leakage-in-stateless) (critical, CVSS 10, published 29 Jul 2026) - [CVE-2026-16498: HashiCorp terraform-mcp-server cross-tenant credential reuse in stateless mode](https://junglewise.ai/threats/cve-2026-16498-hashicorp-terraform-mcp-server-cross-tenant-credential-reuse-in) (critical, CVSS 10, published 28 Jul 2026) - [CVE-2026-16496: HashiCorp terraform-mcp-server auth bypass in stateful transport mode](https://junglewise.ai/threats/cve-2026-16496-hashicorp-terraform-mcp-server-auth-bypass-in-stateful-transport) (high, CVSS 8.9, published 28 Jul 2026) - [CVE-2026-14869: HashiCorp terraform-mcp-server SSRF in streamable-HTTP transport](https://junglewise.ai/threats/cve-2026-14869-hashicorp-terraform-mcp-server-ssrf-in-streamable-http-transport) (high, CVSS 8.6, published 28 Jul 2026) - [CVE-2026-14896: HashiCorp Nomad authorization bypass in dynamic host volumes](https://junglewise.ai/threats/cve-2026-14896-hashicorp-nomad-authorization-bypass-in-dynamic-host-volumes) (medium, CVSS 4.2, published 8 Jul 2026) ## Most severe HashiCorp vulnerabilities - [CVE-2026-16326: HashiCorp consul-mcp-server session state leakage in stateless mode](https://junglewise.ai/threats/cve-2026-16326-hashicorp-consul-mcp-server-session-state-leakage-in-stateless) (critical, CVSS 10, published 29 Jul 2026) - [CVE-2026-16498: HashiCorp terraform-mcp-server cross-tenant credential reuse in stateless mode](https://junglewise.ai/threats/cve-2026-16498-hashicorp-terraform-mcp-server-cross-tenant-credential-reuse-in) (critical, CVSS 10, published 28 Jul 2026) - [CVE-2026-110720: HashiCorp Consul-k8s authorization bypass in ACL binding rules](https://junglewise.ai/threats/cve-2026-110720-consul-k8s-versions-0-42-0-and-later-are-vulnerable-to-a-cross) (critical, CVSS 9.9, published 26 Oct 2026) - [CVE-2026-16496: HashiCorp terraform-mcp-server auth bypass in stateful transport mode](https://junglewise.ai/threats/cve-2026-16496-hashicorp-terraform-mcp-server-auth-bypass-in-stateful-transport) (high, CVSS 8.9, published 28 Jul 2026) - [CVE-2026-7474: HashiCorp Nomad path traversal in Dynamic Host Volumes](https://junglewise.ai/threats/cve-2026-7474-hashicorp-nomad-path-traversal-in-dynamic-host-volumes) (high, CVSS 8.8, published 12 May 2026) - [CVE-2026-119168: HashiCorp Nomad symlink following in allocation data migration](https://junglewise.ai/threats/cve-2026-119168-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-symlink) (high, CVSS 8.8, published 29 Oct 2026) - [CVE-2026-105608: HashiCorp Consul authorization bypass in service mesh proxy registration](https://junglewise.ai/threats/cve-2026-105608-hashicorp-consul-and-consul-enterprise-are-vulnerable-to-an) (high, CVSS 8.8, published 26 Oct 2026) - [CVE-2026-13303: HashiCorp Boundary SSRF in Vault credential store integration](https://junglewise.ai/threats/cve-2026-13303-hashicorp-boundary-and-boundary-enterprise-are-vulnerable-to-a) (high, CVSS 8.7, published 29 Oct 2026) - [CVE-2026-14891: HashiCorp Nomad sandbox escape in Docker task driver](https://junglewise.ai/threats/cve-2026-14891-hashicorp-nomad-sandbox-escape-in-docker-task-driver) (high, CVSS 8.7, published 8 Jul 2026) - [CVE-2026-16328: HashiCorp consul-mcp-server SSRF and token exfiltration](https://junglewise.ai/threats/cve-2026-16328-hashicorp-consul-mcp-server-ssrf-and-token-exfiltration) (high, CVSS 8.6, published 29 Jul 2026) ## Vulnerabilities per week 9 vulnerabilities in the last four weeks, up 800% on the four before (1). 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 5 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 9 | 1 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 2 | 0 | 0 | ## HashiCorp technologies - [HashiCorp Consul](https://junglewise.ai/threats/technologies/consul): 11 vulnerabilities - [HashiCorp Vault](https://junglewise.ai/threats/technologies/vault): 11 vulnerabilities - [HashiCorp Nomad](https://junglewise.ai/threats/technologies/nomad): 9 vulnerabilities - [HashiCorp Vault Enterprise](https://junglewise.ai/threats/technologies/vault-enterprise): 9 vulnerabilities - [HashiCorp Consul Enterprise](https://junglewise.ai/threats/technologies/consul-enterprise): 8 vulnerabilities - [HashiCorp Nomad Enterprise](https://junglewise.ai/threats/technologies/nomad-enterprise): 8 vulnerabilities - [HashiCorp Consul-Template](https://junglewise.ai/threats/technologies/consul-template): 3 vulnerabilities - [HashiCorp Terraform MCP Server](https://junglewise.ai/threats/technologies/terraform-mcp-server): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "HashiCorp vulnerabilities", https://junglewise.ai/threats/vendors/hashicorp, 13 November 2026.