Description
Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
Published: 2026-04-17
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Server-Side Request Forgery (SSRF) leading to potential information disclosure
Action: Immediate Patch
AI Analysis

Impact

Vault’s PKI engine allowed ACME http-01 and tls-alpn-01 challenges to be validated against local or attacker‑controlled DNS targets. This flaw permits the server to issue HTTP requests to internal services, exposing sensitive data that should remain unavailable to external clients.

Affected Systems

The vulnerability affects HashiCorp Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0 as well as earlier Enterprise releases 1.21.5, 1.20.10, and 1.19.16. Any deployment of these versions that performs ACME challenge validation is potentially exposed.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate impact. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting an unknown exploitation probability. The likely attack vector involves manipulating DNS for a domain used in ACME challenge validation, enabling an attacker to direct Vault’s internal request to a local resource. The potential impact is data leakage from internal services vulnerable to SSRF.

Generated by OpenCVE AI on April 17, 2026 at 04:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Vault to version 2.0.0 or later, or to Enterprise 1.21.5, 1.20.10, or 1.19.16 if already using those specific releases
  • If an upgrade is not immediately possible, temporarily disable ACME challenge validation in the Vault PKI configuration
  • Configure network segmentation or firewall rules to prevent internal services from responding to requests originating from Vault’s ACME validation process

Generated by OpenCVE AI on April 17, 2026 at 04:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-8r5m-3f66-qpr3 HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS
History

Mon, 27 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*
cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*

Sat, 18 Apr 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 17 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 17 Apr 2026 05:15:00 +0000

Type Values Removed Values Added
First Time appeared Hashicorp
Hashicorp vault
Hashicorp vault Enterprise
Vendors & Products Hashicorp
Hashicorp vault
Hashicorp vault Enterprise

Fri, 17 Apr 2026 03:30:00 +0000

Type Values Removed Values Added
Description Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
Title Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Hashicorp Vault Vault Enterprise
cve-icon MITRE

Status: PUBLISHED

Assigner: HashiCorp

Published:

Updated: 2026-04-17T17:57:55.377Z

Reserved: 2026-03-27T17:50:20.727Z

Link: CVE-2026-5052

cve-icon Vulnrichment

Updated: 2026-04-17T13:20:00.609Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-17T04:16:12.567

Modified: 2026-04-27T15:03:10.610

Link: CVE-2026-5052

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-04-17T02:55:25Z

Links: CVE-2026-5052 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T05:00:05Z

Weaknesses