HashiCorp Vault EUVD-2026-94641

Requires a Vault PKI secrets engine with the ACME server enabled and operating under the default directory policy - this specific configuration is the precondition, as the flaw is that ACME challenges under that policy do not validate certain certificate identities. Exploitation is further limited to environments where the issued certificates are actually trusted by relying systems (otherwise the unverified identity claim has no impact). The CVSS AC:H reflects this configuration dependency; no user interaction or prior authentication beyond normal ACME client participation is required (PR:N/UI:N). Impact is confined to certificate identity integrity (impersonation); it does not expose confidentiality or cause denial of service.

This is a moderate-severity integrity flaw rather than an urgent priority. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, 5.9 MEDIUM) indicates a network-reachable, unauthenticated issue with HIGH attack complexity and impact limited to integrity (I:H; C:N/A:N) - consistent with the CWE-345 (Insufficient Verification of Data Authenticity) classification and the description of certificates issued with unverified identity claims. The AC:H rating reflects that exploitation depends on a specific, non-default-safe configuration: a Vault PKI mount running the ACME server under the default directory policy. No EPSS score, CISA KEV entry, POC, or SSVC decision data was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent - there is no conflict between the network vector and the description, since ACME is a network protocol - but the practical risk is bounded by the HIGH complexity and the requirement that an operator have deployed Vault as an ACME CA whose issued certificates are trusted by relying systems. Treat this as a configuration-hardening and patch-management item for affected Vault PKI deployments rather than a drop-everything emergency.

An attacker able to reach a Vault PKI mount's ACME directory requests a certificate through the normal ACME challenge flow but includes identity fields (e.g., identifiers the ACME challenges never actually validate) under the default directory policy. Vault issues a certificate asserting those unverified identities, which the attacker then presents to any system configured to trust certificates from that Vault PKI mount, enabling impersonation. No public exploit code was identified in the provided data, and the HIGH attack complexity reflects the need for a vulnerable ACME directory configuration.