What’s Vulnerable › Vulnerabilities
CVE-2026-13303: Boundary vulnerable to server-side request forgery in Vault credential store
- Severity: high (CVSS 8.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-29 · updated 2026-10-30
- Weakness: CWE-918
Description
HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue outbound requests to a network destination of the requester's choosing and to receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service. This vulnerability, CVE-2026-13303, is fixed in Boundary Enterprise 1.0.2 and 0.21.6.
Affected products
- HashiCorp Boundary: from 0.21.3
- HashiCorp Boundary Enterprise: from 0.21.3 before 1.0.2 — fixed in 1.0.2, 0.21.6
How to fix
Upgrade to a fixed version: HashiCorp Boundary Enterprise 1.0.2, 0.21.6. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-13303 or the next vulnerability affects your stack