What is the CVSS score of CVE-2026-5807?

CVE-2026-5807 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Vault are affected by CVE-2026-5807?

HashiCorp Vault versions prior to 2.0.0 contain an unauthenticated denial-of-service vulnerability that allows attackers to block critical administrative functions including root token generation and…. A patch is available.

How to fix or mitigate CVE-2026-5807?

Within 24 hours: Inventory all HashiCorp Vault deployments and identify instances running versions prior to 2.0.0. Within 7 days: Test upgrade to Vault 2.0.0 or later in a non-production environment and validate root token and rekey workflow functionality. Within 30 days: Deploy patched Vault 2.0.0 or later to all production environments and document completion.

Vault CVE-2026-5807

EUVD-2026-23362 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-04-17 HashiCorp

GHSA-88v5-9hxc-f85r

Denial Of Service Hashicorp Vault Vault Enterprise

7.5

CVSS 3.1 · Vendor: HashiCorp

Severity by source

Vendor (HashiCorp) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (HashiCorp).

CVSS VectorVendor: HashiCorp

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Apr 27, 2026 - 15:03 nvd

Patch available

Analysis Updated

Apr 17, 2026 - 05:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 17, 2026 - 05:22 vuln.today

cvss_changed

Patch available

Apr 17, 2026 - 05:01 EUVD

Analysis Generated

Apr 17, 2026 - 04:41 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 04:30 euvd

EUVD-2026-23362

Analysis Generated

Apr 17, 2026 - 04:30 vuln.today

CVE Published

Apr 17, 2026 - 03:22 nvd

HIGH 7.5

DescriptionCVE.org

Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate operators from completing these workflows. This vulnerability, CVE-2026-5807, is fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0.

AnalysisAI

HashiCorp Vault unauthenticated denial-of-service vulnerability allows remote attackers to block critical administrative operations by monopolizing the single operation slot for root token generation and rekey workflows. Affects all Vault Community and Enterprise versions prior to 2.0.0. No active exploitation confirmed (EPSS 3rd percentile), but attack is trivially automatable per CISA SSVC framework. HashiCorp released patches in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0.

Technical ContextAI

HashiCorp Vault is a secrets management platform used to secure, store, and control access to tokens, passwords, certificates, and encryption keys. This vulnerability exploits CWE-770 (Allocation of Resources Without Limits or Throttling) in Vault's administrative workflow handling. Vault enforces a single-operation concurrency model for sensitive operations like root token generation and cluster rekey processes-only one such operation can be in-progress at a time. The affected code path lacks rate-limiting or authentication checks on operation initiation and cancellation endpoints, allowing attackers to spam these endpoints over the network (AV:N) with no credentials required (PR:N). The CPE strings cpe:2.3:a:hashicorp:vault and cpe:2.3:a:hashicorp:vault_enterprise indicate both product lines share the vulnerable code path. ENISA tracking (EUVD-2026-23362) confirms European infrastructure exposure.

RemediationAI

Upgrade to HashiCorp Vault Community Edition 2.0.0 or Vault Enterprise 2.0.0 per vendor advisory HCSEC-2026-08 at https://discuss.hashicorp.com/t/hcsec-2026-08-vault-vulnerable-to-denial-of-service-via-unauthenticated-root-token-generation-rekey-operations/77345. For environments unable to upgrade immediately, implement network-layer rate limiting on Vault API endpoints (specifically /sys/generate-root/* and /sys/rekey/* paths) to throttle unauthenticated requests-limit to 1-5 requests per minute per source IP. Deploy IP allowlisting via firewall rules or reverse proxy to restrict administrative API access to known operator networks or bastion hosts. Note that allowlisting reduces operational flexibility for distributed teams and may conflict with automated tooling that performs scheduled maintenance. Monitor Vault audit logs for abnormal volumes of generate-root or rekey initiation/cancellation events as attack indicators. Compensating controls reduce but do not eliminate risk since attackers within allowed IP ranges can still exploit the vulnerability. Testing patch in non-production is critical as Vault 2.0.0 represents a major version upgrade that may include breaking changes to plugin interfaces or configuration syntax.