CVE-2026-105816

Received Received - Intake

Arbitrary Code Execution in HashiCorp Vault

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: HashiCorp Inc.

Description

Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory configured, a privileged operator able to restore an Integrated Storage (Raft) snapshot may be able to execute arbitrary code on the Vault host. This vulnerability (CVE-2026-105816) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-07

Generated

2026-10-08

AI Q&A

2026-10-08

EPSS Evaluated

N/A

NVD

CVE-2026-105816

Affected Vendors & Products

Vendor	Product	Version / Range
HashiCorp	Vault	0.0.1
HashiCorp	Vault	Enterprise 0.0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Vault and Vault Enterprise failed to consistently check that plugin catalog entries point to binaries within the allowed plugin directory. When using Shamir seals with an external plugin directory, a privileged operator who can restore an Integrated Storage (Raft) snapshot might execute arbitrary code on the Vault host.

Detection Guidance

Check Vault version with 'vault version' and compare against fixed versions (2.1.2 for Community, 2.1.2/1.21.12/1.20.17/1.19.23 for Enterprise). Inspect plugin directory configuration in Vault's config file for external paths.

Impact Analysis

A privileged attacker could restore a malicious snapshot to gain arbitrary code execution on the Vault server, potentially leading to data breaches, unauthorized access, or system compromise if the Vault manages sensitive secrets or credentials.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected Vault versions may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Upgrade Vault to fixed versions immediately. If unable to upgrade, restrict snapshot restore permissions to trusted operators only and review plugin directory configurations for unauthorized binaries.

Hi! I’m here to help you understand CVE-2026-105816. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70