CVE-2026-5807
Received Received - Intake
Denial-of-Service in Vault Root Token Generation Blocks Operators

Publication date: 2026-04-17

Last updated on: 2026-04-27

Assigner: HashiCorp Inc.

Description
Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate operators from completing these workflows. This vulnerability, CVE-2026-5807, is fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-17
Last Modified
2026-04-27
Generated
2026-06-16
AI Q&A
2026-04-17
EPSS Evaluated
2026-06-14
NVD
CVE-2026-5807
EUVD
EUVD-2026-23362
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
hashicorp vault to 2.0.0 (exc)
hashicorp vault to 2.0.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in Vault allows an unauthenticated attacker to cause a denial-of-service condition by repeatedly initiating or canceling root token generation or rekey operations.

Because Vault only allows one such operation to be in progress at a time, the attacker can occupy this single operation slot, preventing legitimate operators from completing these critical workflows.

Impact Analysis

The impact of this vulnerability is a denial-of-service condition where legitimate users are blocked from completing root token generation or rekey operations.

This can disrupt normal Vault operations, potentially delaying critical security management tasks and affecting availability.

Mitigation Strategies

To mitigate this vulnerability, upgrade Vault to version 2.0.0 or later, as the issue is fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-5807. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart