HashiCorp Boundary CVE-2026-13303

Requires an authenticated Boundary user who already holds project-level permission to manage credential stores and credential libraries, and the Vault credential store integration must be in use; the attacker abuses that configuration path to set an arbitrary request destination. Exploitation is limited by this high-privilege prerequisite (PR:H) - it is an insider or compromised-account scenario, not anonymous access. Real-world impact is greatest when the controller host can reach sensitive internal-only endpoints such as a cloud instance metadata service; in deployments where no such internal endpoints are reachable from the controller, the practical value to an attacker is reduced.

This is a credible, moderately prioritized issue rather than a drop-everything emergency, and the signals are largely consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N, base 8.7) shows a network-reachable, low-complexity flaw whose single real gate is privilege: PR:H means the attacker must already hold project-level rights to manage credential stores and credential libraries, so this is an authenticated-insider or compromised-operator scenario, not an anonymous internet attack. The scope change (S:C) is well justified because the Boundary controller is coerced into reaching systems and network segments the attacker otherwise cannot touch. The vuln.today decision label is 'this_week', which aligns with a serious-but-gated SSRF; no CISA KEV listing and no EPSS score were provided, and no public exploit was supplied, so there is no evidence of active or widespread exploitation at time of analysis. The main caveat: the description says both Boundary and Boundary Enterprise are affected, but the input only lists fixes for 'Boundary Enterprise 1.0.2 and 0.21.6' - verify the fixed build for the community/OSS edition with HashiCorp. Overall this warrants prompt patching, especially where the Boundary controller runs in a cloud environment with reachable instance metadata, but the PR:H requirement meaningfully constrains real-world exploitability.

An authenticated Boundary user who holds permission to manage credential stores and credential libraries in a project configures a Vault credential store (or library) pointing at an attacker-chosen address, causing the controller to issue an outbound request to that destination and return the response to the requester. Because the request originates from the controller's host, the attacker can reach internal-only endpoints such as a cloud instance metadata service (e.g., 169.254.169.254) and read the response. No public exploit was identified at time of analysis.