CVE-2026-4525 HIGH

CVE-2026-4525: Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header

Vendor Hashicorp
Product Vault
Weakness CWE-201
Published April 17, 2026
Last update June 30, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

Key dates

02Disclosure timeline

April 17, 2026 CVE published
June 30, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-62305 HCL AION is affected by a vulnerability where certain operations may trigger out-of-band interactions CVE-2025-49294 WordPress Crawlomatic Multisite Scraper Post Generator plugin <= 2.6.8.2 - Sensitive Data Exposure via Log Exposure vulnerability CVE-2026-39570 WordPress 12 Step Meeting List plugin <= 3.19.9 - Sensitive Data Exposure vulnerability CVE-2017-2582 CVE-2025-49918 WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.2 - Sensitive Data Exposure vulnerability