VDB
CVE-2026-3605
CVE-2026-3605
PUBLISHED
CVSS 8.699999809265137 HIGH
Vault ist ein identitätsbasiertes System zur Verwaltung von Geheimnissen und Verschlüsselung.
EPSS 0.38% · 31.3th percentile
Risk Scores
CVSS 4.0
8.699999809265137
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS Score
0.38%
31.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hashicorp | Hashicorp Vault Enterprise <1.20.10 | |
| Hashicorp | Hashicorp Vault Enterprise <1.19.16 | |
| Hashicorp | Hashicorp Vault Enterprise <2.0.0 | |
| Hashicorp | Hashicorp Vault Community Edition <2.0.0 | |
| Hashicorp | Hashicorp Vault Enterprise <1.21.5 |
Timeline
- Apr 16, 2026 CVE Published
- Apr 17, 2026 PoC Published
- Apr 17, 2026 Security Advisory
- May 18, 2026 EPSS Score
- May 19, 2026 EPSS Score
- May 21, 2026 EPSS Score
- May 22, 2026 EPSS Score
- May 23, 2026 EPSS Score
- May 25, 2026 EPSS Score
- May 26, 2026 EPSS Score
- May 27, 2026 EPSS Score
- May 29, 2026 EPSS Score
References
- https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1164.json advisory
- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1164 advisory
- https://discuss.hashicorp.com/t/hcsec-2026-05-vault-kvv2-metadata-and-secret-deletion-policy-bypass-denial-of-service/77342 advisory
- https://discuss.hashicorp.com/t/hcsec-2026-06-vault-vulnerable-to-server-side-request-forgery-in-acme-challenge-validation-via-attacker-controlled-dns/77343 advisory
- https://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344 advisory
- https://discuss.hashicorp.com/t/hcsec-2026-08-vault-vulnerable-to-denial-of-service-via-unauthenticated-root-token-generation-rekey-operations/77345 advisory