https://spaceraccoon.github.io/vulnerability-spoiler-alert Vulnerability alerts for hashicorp/vault en-us Tue, 01 Sep 2026 14:23:07 GMT https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/540 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/540 Fri, 21 Aug 2026 19:14:18 GMT The PKI secrets engine's key update endpoint did not enforce uniqueness of the 'key_name' field. An attacker with permission to update their own key could rename it to match an existing key's name, creating duplicate names. Since many PKI operations resolve key references by name, this ambiguity could lead Vault to use the attacker's key when creating issuers or signing certificates. The patch calls getKeyName to reject duplicate names, except when the new name resolves to the same key. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/541 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/541 Fri, 21 Aug 2026 19:16:15 GMT The PKI key update endpoint did not validate uniqueness of the key name, allowing a user with permission to rename a key to set it to a name already used by another key. This could cause name resolution collisions where operations referencing the key by name might affect the wrong key, leading to denial of service or operational confusion. The patch adds a uniqueness check and rejects duplicate names unless the new name resolves to the same key. low verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/522 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/522 Fri, 21 Aug 2026 04:01:26 GMT An unauthenticated remote attacker can trigger a nil pointer dereference panic in Vault's aliasNameFromLoginRequest by sending a malformed AppRole login request where secret_id is a JSON object instead of a string. The panic is caught per-connection by net/http, but it drops the connection and logs a stack trace, allowing repeated requests to cause denial of service through log flooding and CPU exhaustion. The patch adds nil checks for resp and resp.Auth before accessing resp.Auth.Alias. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/516 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/516 Thu, 20 Aug 2026 22:29:28 GMT Before the patch, JWT auth profiles created prior to the introduction of the profiles-by-issuer index had no entry under that path. The issuer->namespace map used for token revocation was therefore incomplete, causing silent lookup failures when attempting to revoke tokens for those issuers. This allowed tokens issued by such profiles to survive namespace deletion or other revocation events, retaining unauthorized access. The patch adds a migration at unseal to backfill missing index entries, restoring complete revocation coverage. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/515 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/515 Thu, 20 Aug 2026 16:25:00 GMT Before the patch, JWT tokens created via the OIDC/JWT auth method were not revoked in all namespaces when the associated profile (role) was deleted. This allowed an attacker who had previously authenticated to retain a valid Vault token after the role was removed, bypassing authorization. The patch ensures JWT tokens are correctly excluded from a legacy non-service token cleanup path that interfered with revocation, and adds revocation across all namespaces where the profile exists. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/494 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/494 Wed, 19 Aug 2026 17:17:45 GMT The operator namespace HTTP access control was not enforced; sensitive sys endpoints (seal, unseal, step-down, etc.) were always registered under /v1/sys/ regardless of the configured operator namespace path. This allowed clients in non-operator namespaces to access these endpoints, bypassing the intended namespace isolation. The patch routes these endpoints under the operator namespace prefix, enforcing the isolation. high confirmed CVE-2026-12624 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/462 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/462 Tue, 18 Aug 2026 17:16:59 GMT The OIDC provider UI route directly redirected unauthenticated users to the 'redirect_uri' query parameter when 'prompt=none' was specified. Since 'redirect_uri' was not validated, an attacker could craft a link that redirects victims to an arbitrary external site, enabling phishing or credential theft scenarios. The patch removes this direct client-side redirect and routes unauthenticated users through the standard Vault auth flow instead. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/425 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/425 Mon, 17 Aug 2026 19:20:21 GMT The normalizeOAuthJwtToId function extracted a unique identifier (such as 'jti') from JWT claims without verifying the JWT signature. An attacker could forge a JWT with a victim's token ID as the jti and use it to look up, renew, or revoke token entries. The patch replaces it with normalizeJwtForLookup, which validates the JWT and returns an error for invalid tokens. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/371 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/371 Wed, 05 Aug 2026 09:52:39 GMT The DisplayName field, which is user/token controlled (e.g., from token display names or OIDC/JWT claims), was passed unsanitized into database username templates used to generate credentials, allowing SQL metacharacters or malicious payloads to be injected into generated usernames sent to the database. The patch adds sanitizeDisplayName to strip all characters except alphanumerics, hyphens, and underscores before using DisplayName in the credential generation request, and adds a warning for username_template usage without truncation. high verified