HashiCorp Tooling vulnerabilities

11 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Latest HashiCorp Tooling vulnerabilities

CVE-2026-110720 — Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules (CVSS 9.9)
CVE-2026-87993 — Consul-template vulnerable to an information disclosure issue in error handling (CVSS 7.7)
CVE-2026-8715 — Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath (CVSS 9.6)
CVE-2026-16328 — consul-mcp-server vulnerable to server side request forgery leading to token exposure (CVSS 8.6)
CVE-2026-16326 — consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode (CVSS 10.0)
CVE-2026-16498 — terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode (CVSS 10.0)
CVE-2026-16496 — terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user (CVSS 8.9)
CVE-2026-14869 — terraform-mcp-server vulnerable to server side request forgery leading to token exposure (CVSS 8.6)
CVE-2026-14361 — Consul-template is vulnerable to path redirection in writeToFile through symlink attack (CVSS 4.7)
CVE-2026-5061 — Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack (CVSS 4.7)
CVE-2026-4660 — Go-getter may allow to arbitrary filesystem reads through git operations (CVSS 7.5)