Vault CVE-2026-5052

Exploitation requires that: (1) the target Vault instance has the PKI engine enabled and ACME feature active; (2) the attacker can influence DNS resolution for a domain used in an ACME certificate request, either through network-level DNS hijacking (compromised DNS server, ARP spoofing, BGP hijacking) or by registration of a domain where they control the authoritative DNS server; (3) the ACME challenge request must be allowed to reach local/private network targets without filtering by Vault's validation logic. Default Vault configurations with ACME enabled are vulnerable. No authentication is required to submit ACME certificate requests, though rate-limiting may apply depending on Vault configuration. The vulnerability does NOT require user interaction, special Vault configuration options, or non-default deployment modes - it is a flaw in the core ACME validation logic that affects all instances running vulnerable versions with ACME enabled.

CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates network-accessible, unauthenticated exploitation with low complexity, resulting in confidentiality impact without integrity or availability impact. This aligns with SSRF-class vulnerabilities where the primary harm is information disclosure via unintended request routing. The KEV status is not provided, so active exploitation is not confirmed; however, SSRF vulnerabilities targeting certificate issuance pipelines are actively researched. The attack requires DNS control or man-in-the-middle positioning but not user interaction, making it a real concern in environments where attackers can influence DNS (corporate networks with compromised DNS servers, cloud environments with shared DNS infrastructure, or ISP-level compromise). The CVSS score reflects the limited direct impact (confidentiality only, no code execution or service disruption), but the reputational and operational risk is higher if internal service data is disclosed during certificate issuance workflows. Exploitation likelihood is elevated if Vault instances accept ACME requests from untrusted sources (e.g., public ACME client libraries or cloud integrations) without rate-limiting or validation-request logging.

An attacker compromises a DNS server or performs DNS cache poisoning to redirect a Vault ACME client's domain validation request. When the attacker-controlled domain in an ACME certificate request resolves to 192.168.1.10 (an internal web application), Vault's PKI engine fails to reject this as a local target and sends an http-01 challenge request to the internal application. The internal application responds with metadata, API keys, or configuration data in its HTTP response, which Vault logs or returns, disclosing sensitive information to the attacker. Alternatively, the attacker targets 127.0.0.1 or another loopback address to trigger requests to Vault's own internal services or co-hosted applications on the same host.