CVE-2026-5051 MEDIUM

CVE-2026-5051: Audit Log Plugin Directory Guard Bypass via Legacy path Option

Vendor Hashicorp
Product Vault
Weakness CWE-22 · Path traversal
Published July 1, 2026
Last update July 1, 2026
View on NVD All CVEs

CVSS base score

4.4/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used. This vulnerability (CVE-2026-5051) is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17.

Key dates

02Disclosure timeline

July 1, 2026 CVE published