CVE-2026-5807

Modified Modified - Updated After Analysis

Denial-of-Service in Vault Root Token Generation Blocks Operators

Publication date: 2026-04-17

Last updated on: 2026-06-30

Assigner: HashiCorp Inc.

Description

Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate operators from completing these workflows. This vulnerability, CVE-2026-5807, is fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-17

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-04-17

EPSS Evaluated

2026-07-05

NVD

CVE-2026-5807

EUVD

EUVD-2026-23362

Affected Vendors & Products

Vendor	Product	Version / Range
hashicorp	vault	to 2.0.0 (exc)
hashicorp	vault	to 2.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability in Vault allows an unauthenticated attacker to cause a denial-of-service condition by repeatedly initiating or canceling root token generation or rekey operations.

Because Vault only allows one such operation to be in progress at a time, the attacker can occupy this single operation slot, preventing legitimate operators from completing these critical workflows.

Impact Analysis

The impact of this vulnerability is a denial-of-service condition where legitimate users are blocked from completing root token generation or rekey operations.

This can disrupt normal Vault operations, potentially delaying critical security management tasks and affecting availability.

Mitigation Strategies

To mitigate this vulnerability, upgrade Vault to version 2.0.0 or later, as the issue is fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0.

Hi! I’m here to help you understand CVE-2026-5807. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70