Vault CVE-2026-5807

No special conditions-remote unauthenticated exploitation against default configurations of HashiCorp Vault Community Edition and Vault Enterprise versions prior to 2.0.0. Attack targets administrative API endpoints exposed per standard Vault deployment architecture. Exploitation requires only network connectivity to Vault's API listener (default TCP 8200) and does not depend on specific features being enabled, non-default settings, or authenticated sessions. Attack effectiveness is maximized when Vault API is exposed to untrusted networks without reverse proxy rate limiting. Attack impact is limited to scenarios where legitimate operators need to initiate root token generation or rekey operations during the attack window-organizations not actively performing these administrative tasks experience no functional disruption despite the vulnerability being exploitable.

Real-world risk is MODERATE despite high CVSS 7.5 base score. CVSS vector AV:N/AC:L/PR:N/UI:N indicates trivial network-based exploitation requiring no authentication or user interaction-this aligns with SSVC assessment of 'Automatable: yes'. However, impact is purely availability (A:H/C:N/I:N) targeting administrative workflows, not production secret access. EPSS score of 0.01% (3rd percentile) suggests security researchers assess actual exploitation likelihood as very low, likely because the impact is limited to operational inconvenience rather than data breach. SSVC 'Exploitation: none' confirms no public exploit code or active campaigns. SSVC 'Technical Impact: partial' correctly notes this disrupts administrative operations but does not compromise confidentiality or integrity of stored secrets. Risk prioritization depends heavily on organizational context: environments with frequent root token rotation or active cluster maintenance face higher operational impact than static deployments. The vulnerability is a realistic DoS vector for targeted attacks against organizations known to use Vault, but unlikely to see widespread automated exploitation given limited attacker ROI. KEY LIMITATION: HashiCorp advisory does not specify if existing mitigation controls (API rate limiting, network ACLs) were ineffective-defenders should verify whether standard protective measures reduce real-world exploitability.

An unauthenticated attacker sends automated HTTP requests to Vault's API endpoints for root token generation (/sys/generate-root/attempt) and cluster rekey operations (/sys/rekey/init), rapidly initiating and canceling these operations in a loop. Each request occupies the single concurrency slot Vault reserves for these sensitive workflows. Legitimate administrators attempting to perform emergency root token regeneration or planned cluster rekey operations receive errors indicating an operation is already in progress. The attack continues indefinitely, blocking all administrative recovery workflows until the attacker stops or network-layer defenses interrupt the request stream.