BIT-vault-2026-5051

vendorUSosv

Audit Log Plugin Directory Guard Bypass via Legacy path Option

view advisory published 2026-07-07Licence: per source

HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used. This vulnerability (CVE-2026-5051) is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-5051US	—	0.38% (31st)	—	2026-07-01
HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was…

references

External citations — patches, advisories, analysis.

https://discuss.hashicorp.com/t/hcsec-2026-16-vault-audit-device-plugin-directory-guard-bypass-via-legacy-path-option/77536WEB
https://nvd.nist.gov/vuln/detail/CVE-2026-5051WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan