https://spaceraccoon.github.io/vulnerability-spoiler-alert Vulnerability alerts for hashicorp/vault en-us Tue, 11 Aug 2026 21:01:38 GMT https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/371 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/371 Wed, 05 Aug 2026 09:52:39 GMT The DisplayName field, which is user/token controlled (e.g., from token display names or OIDC/JWT claims), was passed unsanitized into database username templates used to generate credentials, allowing SQL metacharacters or malicious payloads to be injected into generated usernames sent to the database. The patch adds sanitizeDisplayName to strip all characters except alphanumerics, hyphens, and underscores before using DisplayName in the credential generation request, and adds a warning for username_template usage without truncation. high verified