CVE-2026-4525
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A vulnerability in Vault allows the Vault token to be forwarded to the auth plugin backend when an auth mount is configured to pass through the 'Authorization' header. Fixed in versions 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
Risk Assessment
The risk involves unauthorized disclosure of the Vault token, which could lead to privilege escalation or system compromise by an attacker.
Recommendation
Immediately upgrade Vault to one of the patched versions: 2.0.0, 1.21.5, 1.20.10, or 1.19.16.
Other vulnerabilities in Vault
See all- CVE-2026-12624Medium
Vault's ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a trailing slash on the denied path. A token with a broader allow rule and a narrower wildcard deny rule may enumerate entry names beneath a path it was intended to be denied access to.
- CVE-2026-5807High
Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate operators from completing these workflows.
Original NVD description (English source)
If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.