Unauthenticated Credential Exposure in HashiCorp Vault

Executive Summary

HashiCorp Vault versions up to 2.2.1 are vulnerable to CVE-2026-92735. An unauthenticated attacker with network access to an uninitialized node can exploit the integrated storage join process. This allows the attacker to send server environment credentials to a server they control. The issue occurs because the join API accepts unauthenticated cloud auto-join discovery settings, which can redirect credentials to malicious endpoints.

Useful 0 Not Useful 0

Detection Guidance

Check Vault server logs for unusual join API requests from uninitialized nodes. Monitor network traffic to detect outbound connections from Vault nodes to unexpected endpoints during the join process.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability may allow an attacker to steal server environment credentials, such as cloud provider tokens or other sensitive data stored in environment variables. If successful, the attacker could gain unauthorized access to cloud resources or other systems using those credentials. Exposure depends on whether credentials are present in the server's environment.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing server environment credentials if an attacker exploits the flaw. Unauthorized credential exposure may lead to unauthorized access to sensitive data, violating confidentiality requirements under these regulations. Organizations using affected Vault versions must ensure proper network segmentation and apply patches to mitigate risks.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to Vault Community Edition 2.2.2 or Vault Enterprise 2.2.2, 1.21.14, or 1.19.25. Restrict network access to new nodes' API listeners until they join a cluster. Remove cloud auto-join settings from join API configurations and use retry_join stanza instead.

Useful 0 Not Useful 0