What is the CVSS score of CVE-2026-5051?

CVE-2026-5051 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-5051?

Yes, a patch is available for CVE-2026-5051. Update the affected software to the latest version immediately.

HashiCorp Vault CVE-2026-5051

EUVD-2026-41098 MEDIUM

Path Traversal (CWE-22)

2026-07-01 HashiCorp

GHSA-rx9v-2fjr-mhx5

Hashicorp Path Traversal Vault Vault Enterprise Red Hat

4.4

CVSS 3.1 · Vendor: HashiCorp

Severity by source

Vendor (HashiCorp) PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.4 MEDIUM

Requires high-privilege credentials and non-default legacy audit path configuration (AC:H, PR:H); confidentiality impact from path traversal read with no integrity or availability effect.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

4.4 MEDIUM

qualitative

Primary rating from Vendor (HashiCorp).

CVSS VectorVendor: HashiCorp

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 01, 2026 - 19:02 EUVD

Analysis Generated

Jul 01, 2026 - 18:20 vuln.today

DescriptionCVE.org

HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used.

This vulnerability (CVE-2026-5051) is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17.

AnalysisAI

Plugin directory guard bypass in HashiCorp Vault and Vault Enterprise allows a highly privileged, authenticated attacker to read files outside the intended audit plugin directory via path traversal. Exploitation requires network access, high-privilege credentials, and the use of the legacy file audit path option - a non-default configuration. Fixed versions are 2.0.1, 1.21.6, 1.20.11, and 1.19.17; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

HashiCorp Vault (CPE: cpe:2.3:a:hashicorp:vault:*:*:*:*:*:*:*:* and cpe:2.3:a:hashicorp:vault_enterprise:*:*:*:*:*:*:*:*) implements audit devices to log all API requests and responses. A plugin directory protection mechanism is intended to restrict where file audit paths may resolve, preventing writes or reads outside a controlled directory. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal) is the root cause: the audit device validation logic failed to consistently enforce these directory boundary checks when the legacy file audit path option was used, as opposed to the current, non-legacy path handling. This means that path traversal sequences (e.g., '../') supplied in the legacy audit path could escape the plugin directory sandbox.

RemediationAI

The primary fix is to upgrade HashiCorp Vault or Vault Enterprise to one of the patched releases: 2.0.1, 1.21.6, 1.20.11, or 1.19.17, as confirmed by HashiCorp's security advisory at https://discuss.hashicorp.com/t/hcsec-2026-16-vault-audit-device-plugin-directory-guard-bypass-via-legacy-path-option/77536. As an interim workaround, operators should migrate any audit device configurations away from the legacy file audit path option to the current (non-legacy) path mechanism, which correctly enforces plugin directory protections. If the legacy path option cannot be immediately disabled, restrict Vault admin-level credentials to a minimal, audited set of operators to reduce the privilege-abuse surface. Note that disabling the audit device entirely would eliminate audit logging, which is itself a security regression and not recommended.