CVE-2026-5807
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate operators from completing these workflows.
Risk Assessment
The risk is that an attacker can block critical administrative operations such as root token generation or rekeying, potentially leading to system downtime and preventing security management.
Recommendation
It is recommended to immediately upgrade Vault to Community Edition 2.0.0 or Enterprise 2.0.0, which contain the fix for this vulnerability.
Other vulnerabilities in Vault
See all- CVE-2026-12624Medium
Vault's ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a trailing slash on the denied path. A token with a broader allow rule and a narrower wildcard deny rule may enumerate entry names beneath a path it was intended to be denied access to.
- CVE-2026-4525High
A vulnerability in Vault allows the Vault token to be forwarded to the auth plugin backend when an auth mount is configured to pass through the 'Authorization' header. Fixed in versions 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
Original NVD description (English source)
Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate operators from completing these workflows. This vulnerability, CVE-2026-5807, is fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0.