Skip to main content

Hashicorp EUVD-2026-13746

| CVE-2026-32303 HIGH
Origin Validation Error (CWE-346)
2026-03-20 GitHub_M
Information Disclosure Hashicorp
7.6
CVSS 3.1
Share

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None

Lifecycle Timeline

6
Analysis Updated
Apr 16, 2026 - 06:19 EUVD-patch-fix
executive_summary
Re-analysis Queued
Apr 16, 2026 - 05:29 backfill_euvd_patch
patch_released
Patch available
Apr 16, 2026 - 05:29 EUVD
1.19.1
EUVD ID Assigned
Mar 20, 2026 - 18:15 euvd
EUVD-2026-13746
Analysis Generated
Mar 20, 2026 - 18:15 vuln.today
CVE Published
Mar 20, 2026 - 17:57 nvd
HIGH 7.6

DescriptionNVD

Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.1, an integrity check vulnerability allows an attacker to tamper with the vault configuration file leading to a man-in-the-middle vulnerability in Hub key loading mechanism. Before this fix, the client trusted endpoints from the vault config without host authenticity checks, which could allow token exfiltration by mixing a legitimate auth endpoint with a malicious API endpoint. Impacted are users unlocking Hub-backed vaults with affected client versions in environments where an attacker can alter the vault.cryptomator file. This issue has been patched in version 1.19.1.

AnalysisAI

Cryptomator versions prior to 1.19.1 contain an integrity check vulnerability that allows attackers to tamper with the vault.cryptomator configuration file, enabling man-in-the-middle attacks during Hub key loading. Attackers can mix legitimate authentication endpoints with malicious API endpoints to exfiltrate access tokens from users unlocking Hub-backed vaults in environments where vault configuration files can be modified. …

Sign in for full analysis, threat intelligence, and remediation guidance.

RemediationAI

Within 24 hours: Inventory all Cryptomator deployments and identify instances running versions prior to 1.19.1. Within 7 days: Deploy Cryptomator 1.19.1 or later across all affected systems; verify vault configuration files are protected against unauthorized modification with appropriate file system permissions. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

More from same product – last 7 days

CVE-2026-8903 MEDIUM
4.3 May 27

Cross-Site Request Forgery in the Two-factor Authentication (formerly IP Vault) WordPress plugin versions up to and incl
CVE-2026-9223
4.3 May 22

Missing authorization in the vault import feature in Devolutions Server  2026.1.16.0 and earlier allows a low-privileged
CVE-2026-9246
4.3 May 22

Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated
CVE-2026-9248
2.6 May 22

Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write acce

Share

EUVD-2026-13746 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy