CVE Tools
Track your stack

Vault

83 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Vault, a product in the cloud saas space. Use it to gauge the current risk picture and drill into individual advisories.

Vault CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Vault CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-041
2025-052
2025-061
2025-071
2025-089
2025-090
2025-102
2025-110
2025-120
2026-010
2026-020
2026-030
2026-044
2026-050
2026-060
2026-071
2026-082
2026-090
2026-103

Severity

How the 83 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical67%
  • High2834%
  • Medium4453%
  • Low56%

Latest CVEs

The 15 most recently published vulnerabilities affecting Vault.

  1. CVE-2026-89322Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions7.2
  2. CVE-2026-105816Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots8.0
  3. CVE-2026-105818Vault PKI ACME Issues Certificate With Unvalidated SANs5.9
  4. CVE-2026-5006Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths6.8
  5. CVE-2026-12624Vault vulnerable to LIST authorization bypass via trailing-slash strip4.3
  6. CVE-2026-5051Audit Log Plugin Directory Guard Bypass via Legacy path Option4.4
  7. CVE-2026-5807Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations7.5
  8. CVE-2026-4525Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header7.5
  9. CVE-2026-5052Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS5.3
  10. CVE-2026-3605Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service8.1
  11. CVE-2025-12044Vault Vulnerable to Denial of Service Due to Rate Limit Regression7.5
  12. CVE-2025-11621Vault AWS auth method bypass due to AWS client cache8.1
  13. CVE-2025-6203Vault unauthenticated denial of service through complex json payload7.5
  14. CVE-2025-6013Vault LDAP MFA Enforcement Bypass When Using Username As Alias6.5
  15. CVE-2025-6015Vault Login MFA Bypass of Rate Limiting and TOTP Code Reuse5.7

Product grouping is registry-driven, with AI assist and human review. How it works