What’s Vulnerable › Vulnerabilities

CVE-2026-4525: Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-17 · updated 2026-10-25
• Weakness: CWE-201

Description

If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

Affected products

• HashiCorp Vault: from 0.11.2 before 1.19.16; from 0.11.2 before 2.0.0; from 1.20.0 before 1.20.10; from 1.21.0 before 1.21.5 — fixed in 1.19.16, 2.0.0, 1.20.10, 1.21.5

How to fix

Upgrade to a fixed version: HashiCorp Vault 1.19.16, 2.0.0, 1.20.10, 1.21.5. Check the vendor advisory for mitigations.

References

• https://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344
• https://access.redhat.com/security/cve/CVE-2026-4525
• https://bugzilla.redhat.com/show_bug.cgi?id=2459107
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4525.json

Get alerted when CVE-2026-4525 or the next vulnerability affects your stack