Medium severity4.4NVD Advisory· Published Jul 1, 2026· Updated Jul 2, 2026

CVE-2026-5051

Description

HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used.

This vulnerability (CVE-2026-5051) is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17.

Affected products

Hashicorp/Vaultinferred2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <2.0.1
Hashicorp/Vault Enterprisellm-fuzzy
Range: <2.0.1
osv-coords4 versions
pkg:apk/chainguard/splunk-otel-collector pkg:apk/chainguard/splunk-otel-collector-fips pkg:apk/wolfi/splunk-otel-collector pkg:bitnami/vault
< 0.157.0-r0+ 3 more
- (no CPE)range: < 0.157.0-r0
- (no CPE)range: < 0.157.0-r0
- (no CPE)range: < 0.157.0-r0
- (no CPE)range: >= 1.19.0, < 1.19.17

Patches

Vulnerability mechanics

References

discuss.hashicorp.com/t/hcsec-2026-16-vault-audit-device-plugin-directory-guard-bypass-via-legacy-path-option/77536nvd

News mentions

No linked articles in our index yet.

cvss	0.286
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000