Hashicorp

Unsafe Erlang term deserialization in ash_cloak 0.1.0-0.3.x allows an attacker who can influence encrypted column bytes to crash the BEAM runtime node via unbounded atom table exhaustion or a decompression bomb. Applications configured with Cloak's unauthenticated AES.CTR cipher are the highest-risk targets: an authenticated application user who knows their own plaintext can XOR-derive the keystream and write a forged ciphertext of equal length without the encryption key, causing the deserialization to fire on any subsequent column read. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the patch commit confirms two distinct, low-skill attack primitives against unpatched deployments.

Unbounded symlink-following in KubeVela's Terraform remote configuration loader allows any principal with `ComponentDefinition` create/update RBAC rights to OOM-kill the cluster-wide vela-core controller and halt all OAM application reconciliation. The root cause (CWE-59) is that `GetTerraformConfigurationFromRemote` in `pkg/controller/utils/capability.go` calls `os.ReadFile` on a symlink target without verifying the target is a regular file or bounding the read size; a repository containing `variables.tf -> /dev/zero` is sufficient to exhaust controller memory before HCL parsing is ever reached. No CISA KEV listing has been identified at time of analysis, but a complete proof-of-concept with exact reproduction commands is publicly disclosed in GHSA-fmgp-q6jx-gg3x, materially lowering the exploitation bar.

Sensitive-file exposure in the openssl-encrypt pip package (openssl_encrypt) at versions <= 1.4.8 stems from its 'Encrypted USB Workspace' feature writing a marker that falsely declares the workspace AES-256-GCM encrypted while the derived key is never applied and the directory remains in cleartext. Users who trust the branding and store files in the workspace leave them fully readable on the removable media, so anyone with physical possession of the USB device can recover the data. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the failure silently defeats the product's core security promise.

Privilege escalation in HashiCorp Vault allows authenticated low-privileged users to traverse outside their authorized secret paths by injecting forward-slash characters into identity values referenced by templated ACL policy paths. Both Vault Community and Enterprise editions from version 0.11.0 through 2.0.3 are affected across all platforms. No public exploit code or active exploitation is confirmed at time of analysis; however, the high confidentiality and integrity impact make this a priority for any organization using identity-based templated ACL policies.

Path traversal in Atlantis workspace handling (versions 0.19.8 through 0.44.x) allows authenticated users to escape the intended workspace directory boundary, triggering os.RemoveAll and os.MkdirAll operations on arbitrary filesystem paths with Atlantis process privileges. A crafted workspace value such as '../../../../../../../../tmp/f1-canary' - supplied via repository atlantis.yaml or authenticated /api/plan API input - causes Atlantis to operate on out-of-bounds directories before Terraform rejects the invalid workspace name. A working proof-of-concept is documented in GHSA-26w5-6g95-gj28; the vulnerability is not in CISA KEV and no public exploit kit has been identified at time of analysis.

Token exfiltration in Infracost prior to 0.10.45 allows an attacker who controls scanned Terraform source to redirect a configured Terraform Cloud or registry credential to an arbitrary attacker-controlled host. The vulnerable code path in internal/hcl/remote_variables_loader.go derived the destination hostname from untrusted Terraform cloud/backend block attributes without validating it against the operator-configured trusted host. CI pipelines using pull_request_target or same-repository pull request workflows that expose a TFC token to Infracost scans are affected; standard fork pull_request workflows without secrets are explicitly not vulnerable. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.

Vault token disclosure in the N-able PassPortal browser extension (versions before 3.49.6) stems from missing origin validation on postMessage events, classified under CWE-1385. A malicious web page can send a crafted postMessage to the extension listener, causing it to disclose HashiCorp Vault tokens to an untrusted origin - enabling authentication abuse against any Vault instance the user's session is authorized to access. No public exploit code has been identified at time of analysis, but the network-accessible, unauthenticated attack path (UI:A in CVSS 4.0) and high confidentiality impact make this a meaningful credential theft risk for MSP environments.

Improper TLS certificate validation in Splunk SOAR's CyberArk REST client exposes all credential vault traffic to interception and tampering by a network-positioned attacker. Versions below 8.6.0 are affected when a CyberArk REST credential manager integration is configured; the client accepts any server certificate without verification, making TLS sessions transparent to a man-in-the-middle. No public exploit code has been identified at time of analysis, and the vulnerability is absent from the CISA KEV catalog, but the high confidentiality and integrity impact on privileged credential data warrants priority remediation in environments relying on CyberArk for SOAR playbook secrets.

Unicode normalization mishandling in HashiCorp go-slug versions 0.4.0 through 0.18.2 enables a local attacker to circumvent .terraformignore exclusion rules, causing sensitive files to be silently bundled into Terraform slug uploads destined for remote backends. Exploitation requires local filesystem write access to the Terraform working directory and a legitimate operator triggering a slug upload operation - the CVSS vector confirms AV:L/UI:R, narrowing the realistic attack surface to shared workstations, multi-tenant CI/CD environments, or compromised developer machines. Confidentiality impact is rated high (C:H) because excluded files such as credentials, API keys, or Terraform variable files containing secrets may be exposed to remote Terraform Cloud or Enterprise backends; no public exploit has been identified and the vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog.

CSS injection in M-Files Web before version 26.8.16330.2 permits an authenticated vault administrator to embed arbitrary CSS into the web interface, visually manipulating the UI rendered to all other vault users. The CVSS 4.0 vector (PR:H/UI:P) confirms exploitation is gated behind high-privilege admin credentials and requires passive victim interaction, substantially constraining the realistic threat surface. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin lets an authenticated user with credential-creation rights force the controller pod to leak its own Kubernetes service account token. When a HashiCorp Vault Secret Lookup credential configured for kubernetes_role authentication is tested, the kubernetes_auth() routine in awx_plugins/credentials/hashivault.py transmits the pod token to an attacker-supplied URL. With that token the attacker gains Kubernetes API access to control-plane namespaces, enabling full pod CRUD and secret reads including database credentials and the Django SECRET_KEY. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list.

Local privilege escalation in mise (jdx/mise), the polyglot dev tool version manager, allows a local user with UID and GID 1001 to gain ownership of a root-installed system binary. Prior to version 2026.7.1, release tar archives embedded non-root UID/GID 1001 metadata from the build environment, and the standalone install script failed to normalize ownership before placing the binary in shared paths such as /usr/local/bin, leaving the installed executable writable by any user matching that UID/GID pair. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the attack path is mechanically straightforward in multi-user environments where a local account happens to share UID/GID 1001 with the build system.

Arbitrary file deletion in Terragrunt before v1.0.4 allows an attacker who controls a remote module source to delete any file accessible to the Terragrunt process by embedding directory traversal paths in a forged `.terragrunt-module-manifest` file within the module. The deletion occurs automatically during the module download and initialization phase - before OpenTofu or Terraform executes - making CI/CD pipelines that consume external modules particularly exposed. No public exploit has been identified and no CISA KEV listing exists; a vendor-released patch is available in v1.0.4. Note: an 'RCE' tag in the source metadata directly contradicts the vendor advisory's explicit statement that this is a deletion-only primitive with no code execution or data exfiltration capability.

DualSafe Password Manager & Digital Vault Extension (versions up to and including 1.4.35 for Chrome) exposes stored credentials and TOTP codes through an unauthenticated postMessage-based bridge, enabling cross-origin secret exfiltration by any webpage the victim visits. The extension's bridge component processes incoming postMessage calls without validating the sender's origin, meaning an attacker-controlled page can query the vault directly without any extension-level authentication. A publicly available proof-of-concept hosted on GitHub demonstrates the technique; the vulnerability has not been added to the CISA KEV catalog as of this analysis.

Arbitrary file read in HashiCorp Vault Secrets Operator versions 1.3.0 through 1.4.1 lets a low-privileged Kubernetes tenant abuse the AppRole authentication's SecretIDPath configuration to read files from the operator pod's filesystem and exfiltrate their contents to an attacker-controlled endpoint, enabling privilege escalation across the cluster. Because the operator pod typically holds credentials and tokens spanning multiple tenants, a single limited-RBAC tenant can cross trust boundaries (CVSS scope change), yielding a 9.6 rating. No public exploit identified at time of analysis, but the low attack complexity and multi-tenant blast radius make this a high-priority patch.

Credential exposure in hashi-vault-js (npm) leaks live HashiCorp Vault tokens and secret values into application logs and monitoring platforms via unredacted AxiosError objects. Every API method in the library re-throws the raw AxiosError, which carries the full Axios request configuration-including the X-Vault-Token authentication header and request body containing submitted passwords or secrets. Any consuming application that passes caught exceptions to logging utilities (console.error, pino, winston) or observability platforms (Sentry, APM agents) will persistently record live Vault credentials in plaintext. No public exploit has been identified at time of analysis, but the vulnerability is structurally trivial to trigger through normal error-path execution in any affected Node.js service.

Cross-namespace authorization bypass in HashiCorp Vault Enterprise's identity entity batch-delete endpoint allows an authenticated low-privileged caller in one namespace to permanently delete the storage backing of identity entities belonging to a completely separate namespace. Affected are all Vault Enterprise versions prior to the patched releases 2.0.4, 1.21.9, 1.20.14, and 1.19.20. No public exploit or CISA KEV listing has been identified at time of analysis, but the destructive, cross-tenant impact makes this a high-priority patch for any multi-namespace Vault Enterprise deployment.

Cross-team credential disclosure in the Apache Airflow Microsoft Azure provider's Key Vault secrets backend allows any authenticated team member to read credentials belonging to a different team in multi-team deployments running versions prior to 14.1.0. The backend's team-scoped lookup falls through to a team-agnostic resolution when the scoped lookup misses, and an attacker in one team can deliberately trigger this by supplying a connection or variable ID whose normalized form encodes the target team's namespace prefix. No public exploit has been identified at time of analysis, but the attack primitive is directly derivable from the published patch diff, making this a credible insider-privilege escalation risk for any organization using this backend in multi-team mode.

HashiCorp Vault's ACL policy engine inconsistently enforces wildcard (glob) deny rules against LIST requests when a trailing slash is appended to the denied path, enabling an authenticated token holder to enumerate secret entry names beneath paths it was intended to be denied access to. Affected versions span multiple Vault Enterprise release trains and Vault Community Edition prior to 2.0.3, with confirmed fixes released across all active branches. No public exploit code or active exploitation has been identified at time of analysis; the CVSS score of 4.3 (Medium) reflects the constrained impact - path enumeration only - and the authenticated access prerequisite.

Partial arbitrary file read in HashiCorp Consul Community Edition and Enterprise 1.18.21 through 2.0.2 allows a network-accessible, highly-privileged attacker to exfiltrate sensitive credential files from the Consul server host. The flaw is scoped to configurations using the Vault Connect CA provider with JWT or AppRole authentication - a non-default but production-relevant deployment pattern - and requires operator:write permission to exploit. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available in Consul 2.0.3 and corresponding Enterprise builds.

Command injection in sysPass's backup service allows any authenticated administrator to execute arbitrary OS commands as the web server process user by storing shell metacharacters in the backup path configuration setting and triggering a backup operation. Because sysPass is a self-hosted password manager, successful exploitation grants direct read access to the master encryption key and entire credential vault, enabling mass credential disclosure and lateral movement to every system whose passwords are stored in sysPass. A public proof-of-concept is available via the referenced gist (https://gist.github.com/W40X/6747ba1b7da7bb69b0c0e162628df279); no CISA KEV listing was identified at time of analysis.

Cross-namespace traffic hijacking in Traefik's Kubernetes Gateway API provider allows a low-privileged tenant to redirect another namespace's HTTP, GRPC, TCP, or TLS traffic to an attacker-controlled backend. The root cause is a non-injective route identity scheme: namespaces and route names are hyphen-concatenated without field delimiters, so namespace=team/route=a-app and namespace=team-a/route=app produce the identical key httproute-team-a-app-..., and the later-loaded route silently overwrites the earlier one via maps.Copy. No public exploit identified at time of analysis as a KEV entry, but a full proof-of-concept bash script is publicly available and was verified against the official traefik:v3.7.8 image. All Traefik v3 releases prior to v3.6.25 and v3.7.10 are affected.

Missing admin authorization on the embedding management API in Odysseus allows any authenticated non-admin user to overwrite or delete the server-wide embedding backend configuration, redirecting all subsequent embedding operations - including chat messages, RAG queries, memory entries, and vault text - in plaintext to an attacker-controlled URL. All deployments running any version prior to commit bf325f6 are affected. A public exploit and detailed write-up are available, and the CVSS 4.0 score of 8.7 (PR:L) reflects the low barrier to exploitation for any account holder.

Server-side request forgery in bank-vaults vault-secrets-webhook (<= 1.22.2) lets a low-privileged tenant with ConfigMap or Secret create/update rights in any watched namespace force the cluster-wide admission webhook to make attacker-controlled outbound HTTP requests and exfiltrate ServiceAccount JWTs. The webhook trusts the vault.security.banzaicloud.io/vault-addr annotation with no scheme validation or host allowlist, then synchronously mints a SA token (via cluster-wide serviceaccounts/token:create) and POSTs it to the attacker's address, which can be replayed against the real Vault. A vendor patch (v1.23.1) exists and the reporter published a working PoC, but there is no public exploit identified in the wild and the flaw is not in CISA KEV.

Path traversal and query parameter injection in hashi-vault-js (npm, versions ≤ 0.5.1) allow an attacker who can influence identifiers passed to the library to redirect Vault API requests to arbitrary endpoints - including administrative paths such as `/v1/sys/seal` - or inject unauthorized query parameters, all executed under the permissions of the application's configured Vault token. The vulnerability arises because `Vault.js` contains zero calls to `encodeURIComponent()`, concatenating every caller-supplied identifier directly into HTTP URL strings. Two attack vectors are dynamically confirmed in the GHSA advisory: path traversal via `../../sys/seal` as a secret name, and query injection via `1&list=true` as a version value. No public standalone exploit tool has been identified and this CVE is not listed in the CISA KEV catalog.

Credential reuse in Terraform MCP Server allows cross-tenant token leakage, enabling unauthorized tool execution on behalf of other users. The vulnerability affects versions prior to 1.1.0 when the server is run in streamable-HTTP stateless transport mode. No public exploit code is known, but the critical CVSS score and network attack vector indicate high potential risk.

Authorization bypass in HashiCorp's terraform-mcp-server (versions 0.3.0 through 1.0.x) lets an attacker who obtains another user's MCP session identifier execute their own tool calls under the victim's Terraform credentials when the server runs in streamable-HTTP stateful transport mode. Rooted in a session fixation weakness (CWE-384), the flaw carries a CVSS 8.9 with a scope change, meaning cross-user credential misuse against managed infrastructure. No public exploit identified at time of analysis; EPSS is low (0.27%) and CISA SSVC records exploitation as none, indicating no observed active exploitation.

Server-side request forgery in HashiCorp terraform-mcp-server before 1.1.0 allows unauthenticated remote attackers to redirect Terraform API requests and steal server-side authorization tokens via the streamable-HTTP transport. The vulnerability, tracked as CVE-2026-14869, permits an attacker to control the destination of outbound requests, leading to token exposure. No public exploit or active exploitation has been reported at this time.

Server-Side Request Forgery (SSRF) in JFrog Artifactory’s support for Terraform remote repositories allows an authenticated user—or an unauthenticated user if anonymous access is enabled on the repository—to make the Artifactory instance issue outbound HTTP requests to arbitrary destinations and return the response content. This can lead to disclosure of sensitive internal resources and is rated 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No active exploitation or public exploit is known at the time of analysis.

Privilege escalation in sysPass 3.2.11 allows authenticated users with the PUBLICLINK_CREATE profile flag to decrypt passwords of arbitrary vault accounts and store them in public links, enabling unauthenticated retrieval if the link hash is obtained. No active exploitation is confirmed, but public exploit code exists; EPSS probability is low (0.18%).

Missing object-level authorization in sysPass through 3.2.11 allows API token holders to enumerate account metadata, overwrite passwords, and delete any account across the vault without per-account access controls. A public proof-of-concept is available, though EPSS indicates low exploitation probability (0.22%).

Authenticated attackers can bypass access controls in sysPass 3.2.11 and earlier to access, download, or delete any account file attachment, regardless of their ACL permissions, by exploiting missing authorization checks in AccountFileController. Public exploit code is available, but the EPSS score of 0.22% indicates low likelihood of widespread exploitation.

Information disclosure in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local attacker with file system access to read secret variable values stored in cleartext on disk. This occurs when the variables feature is used without selecting a vault for encryption. The vulnerability is not known to be actively exploited, and EPSS indicates a very low exploitation probability (0.08%).

Information disclosure in the Keycloak Admin REST API allows a delegated administrator with view-only permissions to retrieve the resolved client secret from a secure vault instead of the vault placeholder, exposing sensitive credentials. Affected Red Hat builds include Keycloak, Single Sign-On 7, Data Grid 8, and JBoss EAP expansion pack. No active exploitation or public exploit is known; EPSS probability is low (0.21%).

Authentication bypass in Microsoft Azure Key Vault lets a remote, unauthenticated attacker elevate privileges over the network and gain unauthorized access to the secrets, keys, and certificates the service protects. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it 9.8 Critical with full confidentiality, integrity, and availability impact. A vendor patch is available; there is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.70%, 49th percentile) despite CISA SSVC flagging the flaw as automatable with total technical impact.

Gitea's REST API path for making repositories private omits the ClearRepoWatches cleanup present in the web UI path, exposing private repository metadata to ex-watchers from v1.25.4 through v1.26.x. When the visibility transition occurs via PATCH /api/v1/repos/{owner}/{repo} - the canonical path used by terraform-gitea, official SDKs, and CI/CD automation - the updateRepository function clears stars but leaves watch records intact, allowing former watchers to retrieve the full Repository JSON payload (description, branch, language, topics, counts, mirror metadata) via GET /api/v1/user/subscriptions despite having no access to the repository. This is a confirmed incomplete fix relative to GHSA-8fwc-qjw5-rvgp; no public exploit identified at time of analysis, though the advisory provides complete reproduction steps directly derivable from static code analysis.

Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authenticated user bypass the migration URL allow/block list by supplying a permitted public Git URL that HTTP-redirects the server's git subprocess to an otherwise-blocked internal endpoint. Because Gitea validates only the originally submitted URL while git runs with its default http.followRedirects=initial, the redirected internal Git repository is cloned into an attacker-controlled repository, and pull mirrors keep re-fetching it on schedule. No public exploit identified at time of analysis; a vendor-authored local proof-of-concept confirmed the redirect is followed to 127.0.0.1, and EPSS/KEV data were not supplied.

Local File Read in Anyquery's Server Mode lets unauthenticated network attackers exfiltrate arbitrary files (e.g. /etc/passwd, ~/.ssh/id_rsa) readable by the server process. When `anyquery server` is running and reachable, any client speaking the MySQL wire protocol can issue native SQLite CREATE VIRTUAL TABLE statements against built-in reader modules such as csv_reader or log_reader to point at restricted paths, with no authentication or credentials required (CVSS 3.1 base 7.5, C:H/I:N/A:N). A working proof-of-concept is published in the GHSA advisory, so publicly available exploit code exists; there is no CISA KEV listing or EPSS score in the provided data.

Devolutions Server 2026.1.22.0 and 2026.2.11.0 exposes Azure Key Vault client secrets in cleartext within Recovery Kit response files, defeating an explicit 'exclude sensitive data' option that administrators rely on. Any party who obtains a copy of the generated response file can trivially read the credential without any decryption or tooling. No public exploit code exists and the vulnerability is not in CISA KEV; however, because successful exploitation yields a reusable cloud credential, the downstream blast radius in Azure environments substantially exceeds what the 3.3 CVSS base score suggests. A vendor-released patch is available.

Authorization bypass in Sonatype Nexus Repository 3's component upload API lets an account holding only read/browse privileges on a Swift, Terraform, or Conda hosted repository push arbitrary artifacts, defeating the intended write-permission check (CWE-862). The flaw affects the specific upload paths for these three formats and enables unauthorized artifact publishing that can poison downstream builds. No public exploit identified at time of analysis; Sonatype has shipped a fix in release 3.94.0.

Server-side request forgery in the Ruby css_parser gem (< 3.0.0) lets a remote unauthenticated attacker force the parsing server to issue arbitrary HTTP/HTTPS GET requests, and via an attacker-controlled 3xx redirect to a file:// URI, escalate to arbitrary local file disclosure. The flaw sits in CssParser::Parser#read_remote_file, reachable through load_uri! and any add_block! call that supplies base_uri: - Premailer being the canonical consumer - so a single attacker-planted @import url(...) in parsed CSS reaches the sink. Publicly available exploit code exists (author-supplied PoC); there is no public exploit identified as being used in active campaigns, and it is not listed in CISA KEV.

Cross-namespace authorization bypass in HashiCorp Nomad's dynamic host volumes feature permits an authenticated operator holding host volume delete permissions in one namespace to delete sticky volume claims belonging to jobs in a different namespace. Both Nomad Community Edition and Nomad Enterprise are affected from version 0.4.1 up to 2.0.4, with Enterprise additionally receiving backport fixes in 1.11.8 and 1.10.14. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV, limiting immediate risk to multi-tenant deployments where namespace isolation is an enforced security boundary.

Container-to-host sandbox escape in HashiCorp Nomad and Nomad Enterprise lets an authenticated job submitter using the Docker task driver bind-mount an arbitrary host path into their container even when volume bind mounts are administratively disabled, enabling read and write access to files on the underlying host. The scope-changing flaw (CVSS 3.1 8.7) affects the Community and Enterprise editions and is fixed in Nomad 2.0.4 (CE), and Enterprise 2.0.4, 1.11.8, and 1.10.14. There is no public exploit identified at time of analysis and it is not on CISA KEV.

Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any other member's vault key and a victim-scoped access token. The POST /auth-requests/admin-request handler never verifies that the email in the request body belongs to the authenticated caller (CWE-639), so an attacker can create a Trusted Device Encryption admin-approval request for a victim, bound to an attacker-controlled public key; once approved, the encrypted key material is retrievable from an unauthenticated endpoint. Publicly available exploit code exists (a VulnCheck advisory plus a public write-up), and the CVSS 4.0 base score of 9.3 reflects high confidentiality and integrity impact plus a cross-user scope change.

Host namespace escape in HashiCorp Nomad and Nomad Enterprise lets an authenticated job submitter bypass the allow_privileged control for the Docker task driver, launching containers in host PID/network/IPC namespaces to read data from the host or co-located workloads on the same client node. The flaw stems from missing authorization enforcement (CWE-862) and carries a CVSS 7.7 with a changed scope, reflecting cross-tenant impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Memory exhaustion in HashiCorp memberlist before 0.6.0 allows network-accessible attackers to crash individual cluster nodes by sending crafted push/pull state synchronization messages to the gossip port, triggering unbounded memory allocation until the process terminates. The vulnerability is rooted in missing resource limits on incoming gossip state payloads (CWE-770). No public exploit code exists and CISA KEV listing is not confirmed; however, because memberlist underpins HashiCorp Consul, Nomad, and Vault cluster communication, a single exploitable node crash can disrupt distributed coordination in dependent systems.

SQL and DDL injection in the Snowflake Terraform Provider before 2.18.0 lets an attacker who can influence pipeline workspace variables execute arbitrary SQL inside the provider's privileged Snowflake session (CWE-89), enabling data exfiltration and creation of long-lived credentials. A second flaw allows identifier-injection into user-management DDL, so accounts can be minted with attacker-controlled credentials that bypass operator-configured security controls. No public exploit identified at time of analysis; risk is authenticated/insider-driven rather than remote-unauthenticated.

Apache Airflow's Config API leaks plaintext secrets-backend credentials to authenticated users with Config read permission, because per-key environment variable overrides (e.g., AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID) generate synthetic config entries whose names are absent from the sensitive_config_values masking list. Affected deployments are those that configure secrets backends such as HashiCorp Vault via these per-key environment variable patterns, exposing credentials like Vault role_id and secret_id through normal API responses. No public exploit has been identified at the time of analysis; the vendor-released fix is apache-airflow 3.3.0.

Arbitrary file read in HashiCorp Terraform Enterprise allows an authenticated user to escape the intended repository boundary during VCS-based registry module ingestion, pulling files from outside the source repository into a packaged module and downloading them. Because the ingestion process runs with its own filesystem privileges, an attacker can exfiltrate sensitive files (secrets, configuration, tokens) readable by that process. Reported by HashiCorp with no public exploit identified at time of analysis; the CVSS 7.7 (scope-changed) score reflects high confidentiality impact against a self-hosted enterprise platform.

Java object deserialization in the Apache Camel camel-pqc component allows code execution in the key-management application when an attacker who can write to the backing AWS Secrets Manager secret stores a malicious serialized payload. The flaw affects Apache Camel 4.18.0-4.18.2 and 4.19.0-4.20.x, where AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() calls a raw ObjectInputStream.readObject() with no class filter, so gadget side effects fire before the KeyMetadata cast. Rated CVSS 9.8 by Apache, but exploitation genuinely requires IAM write access to the specific secret; there is no public exploit identified at time of analysis and EPSS is low at 0.19% (8th percentile).

Remote code execution via unsafe Java deserialization affects the camel-pqc component of Apache Camel 4.18.0-4.18.2 and 4.19.0-4.20.x. The HashiCorp Vault and AWS Secrets Manager KeyLifecycleManager implementations (and a legacy-migration path in the file-based manager) read post-quantum key metadata back with a raw ObjectInputStream.readObject() lacking any ObjectInputFilter or allow-list, so a principal able to write to the key backend can plant a gadget object that executes during normal key-lifecycle operations. No public exploit has been identified at time of analysis and EPSS is low (0.19%), but SSVC rates technical impact as total; this is an incomplete-remediation follow-on to CVE-2026-40048.

Server-side request forgery and secret disclosure in the Apache Camel camel-iggy consumer (versions 4.17.0-4.18.2 and 4.19.0-4.20.x) allow an actor able to publish to a consumed Iggy stream to inject Camel control headers such as CamelHttpUri into the Exchange. When the consumer feeds a downstream HTTP producer, the attacker redirects the server-side request to internal services or cloud metadata endpoints, and because the producer resolves Camel property placeholders on the attacker-controlled URI, environment variables, application properties, and vault secrets are exfiltrated. No public exploit identified at time of analysis, and EPSS is low (0.15%), but the confidentiality impact is rated High.

Server-side request forgery and secret disclosure in Apache Camel's camel-atmosphere-websocket component allow a remote attacker to hijack downstream server-side HTTP requests by injecting Camel control headers as WebSocket query parameters. Affecting Camel 4.0.0-4.14.7, 4.15.0-4.18.2 and 4.19.0-4.20.x, the flaw lets an attacker set CamelHttpUri to redirect internal HTTP calls (e.g., to cloud metadata endpoints) and force resolution of Camel property placeholders, leaking environment variables, application properties and vault secrets. Where the WebSocket endpoint is exposed without authentication the issue is unauthenticated (CVSS 7.5); there is no public exploit identified at time of analysis and EPSS is low (0.24%).

Server-side request forgery and secret disclosure in Apache Camel's camel-vertx-websocket component (versions 4.0.0-4.14.7, 4.15.0-4.18.2, and 4.19.0-4.20.x) let a WebSocket client inject Camel-internal control headers such as CamelHttpUri because inbound query/path parameters are copied into the Exchange header map without a HeaderFilterStrategy. In routes that bridge the WebSocket consumer into a downstream HTTP producer, an attacker can redirect the server-side HTTP request to internal services or cloud metadata endpoints, and because the HTTP producer resolves Camel property placeholders on the attacker-supplied URI, environment variables, application properties, and vault secrets are resolved and exfiltrated. When the WebSocket endpoint is exposed without authentication (PR:N per CVSS), this is reachable by an unauthenticated remote attacker; there is no public exploit identified at time of analysis, and EPSS is low at 0.24%.

Plugin directory guard bypass in HashiCorp Vault and Vault Enterprise allows a highly privileged, authenticated attacker to read files outside the intended audit plugin directory via path traversal. Exploitation requires network access, high-privilege credentials, and the use of the legacy file audit path option - a non-default configuration. Fixed versions are 2.0.1, 1.21.6, 1.20.11, and 1.19.17; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.

Cleartext password storage in Netflix Lemur's user-update service path allows any attacker who gains read access to the Lemur database, its backups, query logs, or read replicas to obtain directly usable plaintext credentials - no offline cracking required. The flaw affects all Lemur deployments running pip/lemur <= 1.9.1 and is triggered exclusively when an administrator resets a user password through the admin-gated PUT /api/1/users/<id> API endpoint. No public exploit is required: the advisory itself contains precise reproduction steps, and the side effect (immediate login failure for affected users) makes the exposure operationally detectable. No KEV listing exists at time of analysis.

Credential disclosure in Red Hat Ansible Automation Platform 2.5 and 2.6 allows any authenticated user to retrieve plaintext OAuth tokens, vault passwords, and SSH keys by sending forged Worker messages to the Event-Driven Ansible websocket endpoint. The /api/eda/ws/ansible-rulebook endpoint fails to verify permissions on activation_id values, enabling lateral credential theft across tenants. No public exploit identified at time of analysis, but the low attack complexity and scope-changed CVSS of 9.6 make this a high-priority patch.

OpenBao's transit secrets engine crashes the entire server process when an authenticated caller submits a key-creation request combining an asymmetric key type (rsa-*, ecdsa-*, ed25519) with the derived: true parameter. Affected versions confirmed as 2.5.2 and 2.5.4, with earlier versions also likely vulnerable per the GHSA advisory. The server returns no HTTP response, terminates with exit code 2, and the crash propagates to the entire cluster - making this a high-impact availability denial-of-service requiring only a single authenticated API request. Publicly available exploit code exists in the form of a detailed PoC curl command included in the security advisory; no CISA KEV listing is present at time of analysis.

Namespace path canonicalization in OpenBao (versions 0.1.0 through 2.5.4) allows an authenticated token-holder with delegated namespace management capabilities inside a non-root namespace to operate on the containing (parent) namespace itself, rather than only its children. By passing the reserved literal string 'root' as the target namespace path to any `/sys/namespaces/*` endpoint, the path resolves to the containing namespace after canonicalization - because ACL evaluation occurs before that resolution, the access check passes on the child-scoped policy while the actual operation targets the parent. An attacker exploiting this can look up, delete, lock, or patch custom metadata on the containing namespace, with namespace deletion representing the most severe outcome: destroying all secrets, leases, and policies within it. A working public PoC is published in the GitHub Security Advisory (GHSA-mwr2-wmgp-crj6); no confirmed active exploitation in CISA KEV at time of analysis.

Improper access control in Devolutions Server 2026.2.x exposes social login entry metadata to authenticated vault members who lack authorization to view it. By sending crafted API requests to the social login connection endpoint, a low-privileged vault member can enumerate metadata - such as identity provider configurations and connection identifiers - belonging to vaults or entries outside their permitted scope. No active exploitation has been identified (SSVC: none, EPSS: 0.14%), and the vendor-released patch in version 2026.2.5 is available; risk is most meaningful in multi-tenant or strictly segmented vault deployments.

Denial of service in CyberArk Privileged Access Manager (PAM) Self-Hosted Vault allows remote attackers to terminate the Vault service by sending unexpected input under specific configuration scenarios, affecting versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8. Disclosed by Palo Alto Networks (which now owns CyberArk) via Security Bulletin CA26-17 with no public exploit identified at time of analysis, the CVSS 4.0 base score of 8.7 reflects the network-reachable, unauthenticated attack path against a security-critical service. The flaw is a CWE-400 resource/input handling issue that produces a localized DoS rather than code execution or data exposure.

Information disclosure in nezha 2.x server monitoring dashboard exposes private services marked with `EnableShowInService: false` to unauthenticated network visitors through two API endpoints that bypass the intended visibility filter. Attackers who can reach the API can enumerate hidden service names, IDs, and per-server timing data by iterating over public server IDs or guessing numeric service IDs - both low-cardinality spaces in typical deployments. No public exploit is required to leverage this; a fully functional proof-of-concept using only standard `curl` commands is documented in the GitHub security advisory GHSA-vrmh-5mmx-hjwx, and the fix is available in version 2.0.14.

WP Vault 0.8.6.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting an unescaped parameter in the include functionality. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Command injection (CWE-78) in Devolutions Server's built-in PAM provider password rotation templates allows an attacker with vault write access to execute arbitrary OS commands on systems managed by the affected PAM provider. Affected versions include 2026.2.4.0 and all releases at or below 2026.1.20.0, reported directly by the vendor Devolutions. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis, but the high-value nature of a PAM platform managing privileged credentials on downstream systems means the practical blast radius substantially exceeds what the CVSS C:L/I:L scores suggest.

Arbitrary file write in the Altium Enterprise Server Vault Service allows authenticated users to escape the configured storage root via the UploadController image upload endpoint and place content-controlled files anywhere the service account can write. The flaw (CVSS 4.0 base 9.4, CWE-22) escalates to remote code execution, service takeover, or denial of service by overwriting application binaries, configuration files, or dropping payloads in web-accessible directories. No public exploit identified at time of analysis, and Altium 365 cloud deployments are explicitly out of scope.

Unauthenticated file disclosure and arbitrary file read in Altium Enterprise Server prior to 8.1.1 allows any network-reachable attacker to forge signed Vault download URLs using a hard-coded key shipped identically across all installations. Chained with a co-located path traversal in the same download endpoint (and optionally CVE-2026-9152 for enumeration), an attacker can read arbitrary server-side files including configuration and key material, leading to full server compromise. No public exploit identified at time of analysis; CVSS 4.0 score is 10.0 and Altium 365 SaaS is not affected because cloud deployments use object storage rather than the local filesystem.

Cross-Site Request Forgery in the Two-factor Authentication (formerly IP Vault) WordPress plugin versions up to and including 2.1 enables unauthenticated remote attackers to manipulate the plugin's firewall rules and 2FA configuration - potentially disabling protection entirely - by inducing an authenticated site administrator to click a crafted link. The vulnerable surface is the `ipv_save_changes` function in `admin-settings.php`, which lacks proper nonce validation. No public exploit has been identified at time of analysis, and EPSS at 0.02% (6th percentile) reflects very low automated exploitation probability, though the downstream security impact of silently disabling 2FA or firewall rules is disproportionate to the raw CVSS score of 4.3.

Improper access control in Devolutions Server exposes documentation and attachments of sealed vault entries to any authenticated user who holds vault read access. Sealed entries are an explicit security boundary intended to restrict access beyond standard vault permissions - this bypass undermines that control entirely via a crafted API request. No public exploit has been identified and SSVC indicates no known exploitation, but the attack requires only low-privilege authentication, making it accessible to any insider or compromised credential with vault read rights.

Cross-vault authorization bypass in Devolutions Server's entry duplication feature permits an authenticated low-privilege user to exfiltrate documentation and attachments from vaults they cannot access by submitting a crafted save request with a foreign entry identifier. Two distinct version ranges are affected: all releases at or before 2025.3.20.0 and the 2026.1.6.0-2026.1.16.0 branch. EPSS stands at 0.03% (7th percentile), SSVC confirms no known exploitation, and no public exploit code has been identified, making this a low-urgency but meaningful finding for organizations relying on strict vault segregation within their PAM environment.

Missing authorization in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user to bypass vault creation controls via a crafted import request. The flaw targets the vault import API endpoint, enabling unauthorized vault provisioning within a Privileged Access Management platform - a sensitive context where vault-level control can have downstream impact on managed credentials. No public exploit code has been identified at time of analysis, and EPSS scoring at 0.03% (8th percentile) reflects minimal current exploitation likelihood.

Missing authentication in the Altium 365 SearchService lets an unauthenticated network attacker who knows a target workspace identifier interact with that workspace's search index across tenant boundaries via a legacy SOAP endpoint. Affecting Altium 365 cloud deployments (on-premise Altium Enterprise Server is not affected), it enables reading indexed component, project, folder, and user metadata and injecting, modifying, or deleting search index entries - an authentication bypass with no public exploit identified at time of analysis, though CISA's SSVC framework marks the flaw automatable with total technical impact.

Supply-chain compromise of the npm package @beproduct/nestjs-auth (versions 0.1.2 through 0.1.19) delivered the Mini Shai-Hulud worm payload via a malicious postinstall script, harvesting npm, GitHub, AWS, and HashiCorp Vault credentials from any developer or CI host that ran npm install during a 2h37m publication window on 2026-05-11. Confirmed actively exploited during that window via an attacker-controlled npm publish token; clean version 0.1.20 republishes the original 0.1.1 source tree. CVSS 10.0 reflects the unauthenticated, network-driven supply-chain delivery and scope change into the install environment.

Unauthenticated agent token theft in Coder v2 (self-hosted developer workspace platform) stems from azureidentity.Validate() verifying the PKCS#7 signer's certificate chain but skipping signature verification of the signed content itself. Remote attackers who know a target VM's vmId (a UUIDv4) can forge a PKCS#7 envelope containing a legitimate Azure certificate alongside attacker-controlled content and POST it to the unauthenticated /api/v2/workspaceagents/azure-instance-identity endpoint to receive the victim workspace agent's session token, which then unlocks Git SSH keys, OAuth tokens for GitHub/GitLab/Bitbucket, and workspace secrets. No public exploit identified at time of analysis, but the vulnerability is vendor-confirmed via GHSA-6x44-w3xg-hqqf and a detailed root-cause analysis with attack-path diagram is published.

Server-Side Request Forgery in Tenable Terrascan v1.18.3 and prior allows unauthenticated remote attackers to coerce the server into fetching arbitrary URLs, including file:// URIs that enable local file disclosure. The flaw is triggered when Terrascan runs in server mode and parses uploaded ARM or CloudFormation templates whose templateLink.uri, parametersLink.uri, or AWS::CloudFormation::Stack TemplateURL fields point to attacker-controlled destinations. No public exploit identified at time of analysis, and because Terrascan was archived in August 2023, no patch will ever be released.

Server-Side Request Forgery in Tenable's Terrascan IaC scanner (versions 1.18.3 and prior) lets unauthenticated remote attackers read arbitrary local files and exfiltrate ~/.netrc credentials when the tool runs in server mode. Because Terrascan was archived in August 2023, no vendor patch will ever be released, and the daemon binds to 0.0.0.0 with no authentication by default. No public exploit identified at time of analysis, but the CVSS 4.0 score of 9.2 reflects trivial network-reachable abuse paired with significant confidentiality scope change.

Sensitive vault credential disclosure in Palo Alto Networks Trust Protection Foundation allows an authenticated, adjacent-network attacker with low privileges to read secrets from the server's underlying vault (indicated by the HashiCorp tag), then leverage those secrets to impersonate any user in the environment and arbitrarily modify platform configuration. Affected across four active release branches (24.1.x, 24.3.x, 25.1.x, 25.3.x), with fixed versions available from the vendor. No public exploit code exists and CISA has not listed this in KEV; EPSS exploitation probability is 0.01%, reflecting low current threat activity.

Authenticated code execution on Nomad client hosts is possible in HashiCorp Nomad and Nomad Enterprise 1.10.0 through versions prior to 2.0.1 via a path traversal flaw in the dynamic host volume feature. A submitter with volume-creation privileges can escape the intended volume directory and write to or execute code in arbitrary locations on the client node's filesystem, gaining code execution outside the intended sandbox. This flaw is not in CISA KEV and has no public exploit identified at time of analysis; EPSS probability is low at 0.03%.

Arbitrary file read and write on the Nomad client host is achievable through a symlink attack in HashiCorp Nomad's exec2 task driver prior to version 0.1.2. An attacker operating as the Nomad process user with high local privileges can exploit CWE-59 link-following behavior to redirect file operations outside the intended task sandbox, reading or writing arbitrary files on the underlying host. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, but the integrity impact is significant given the scope change to the host system.

Arbitrary file read and write on Nomad client hosts is possible through a symlink attack (CWE-59) affecting HashiCorp Nomad and Nomad Enterprise versions 0.9.0 through 1.x and 2.x prior to fixed releases. A local attacker operating with high privileges - such as a Nomad operator - can plant a malicious symlink that Nomad follows without proper validation, causing the Nomad process to read or write files outside its intended scope on the host filesystem, constituting a scope change per the CVSS vector (S:C). No public exploit exists and CISA has not added this to the KEV catalog; EPSS at 0.01% (1st percentile) and SSVC exploitation status of 'none' confirm this as low active-exploitation risk despite the scope change elevating CVSS to 6.0.

Full administrative database takeover in Google Cloud AlloyDB for PostgreSQL affected clusters provisioned via Terraform or the REST API before 2025-11-03, where those provisioning paths applied an insecure default password. A remote attacker with network reachability to such a cluster could authenticate as a privileged account and gain complete control of the database. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.04%, 12th percentile), consistent with the SSVC assessment of no observed exploitation.

Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actions exploitation. Attackers combined pull_request_target misconfiguration, Actions cache poisoning, and OIDC token memory extraction to publish malicious code under the legitimate TanStack identity. Installing any affected version executes a 2.3 MB obfuscated payload that exfiltrates AWS/GCP/Kubernetes credentials, npm tokens, GitHub secrets, SSH keys, and HashiCorp Vault tokens over encrypted Session/Oxen messenger infrastructure. The payload propagates by republishing victim-maintained packages with identical injection. Socket.dev and the TanStack team confirmed the incident via GHSA-g7cv-rxg3-hmpx. No EPSS or CISA KEV data available for this recent supply-chain attack. CVSS 9.6 reflects the cross-scope credential theft impact (S:C/C:H/I:H), though exploitation requires user-initiated package installation (UI:R).

Improper authorization in Vaultwarden (self-hosted Bitwarden-compatible server) before 1.35.5 lets an authenticated user who was invited as an organization owner and has accepted-but not yet been confirmed-invoke POST /api/ciphers/purge to hard-delete every cipher and attachment in the organization. The endpoint checks only that membership type is Owner and omits the required Confirmed-status check, enabling irreversible organization-wide data loss. There is no public exploit identified at time of analysis, EPSS is negligible (0.04%), and SSVC records no known exploitation.

Cross-organization authorization bypass in Vaultwarden (the Rust-based, self-hosted Bitwarden-compatible server) prior to 1.35.5 lets an attacker who holds Admin rights in one organization pivot into a second organization where they are only a low-privileged member. Because group-management endpoints persist arbitrary MembershipId and CollectionId values without checking org consistency (CWE-285), the attacker can bind their foreign Org B membership into an accessAll Org A group and read - then write - Org B vault data via /api/sync and /api/ciphers. A POC is referenced in the SSVC data (publicly available exploit code exists); it is not in CISA KEV and EPSS is very low (0.03%), consistent with a targeted, multi-step abuse rather than mass exploitation.

Authentication bypass in UltraDAG Core blockchain allows remote unauthenticated attackers to drain all pocket-derived sub-addresses on smart accounts, completely bypassing vault delays and daily spending limits. The StateEngine fails to resolve pocket addresses to their parent account during policy enforcement, treating virtual pocket addresses as unrestricted accounts. Confirmed actively exploited (CISA KEV). Vendor-released patch: commit fb6ef59 resolves pocket-to-parent mapping before all policy checks. EPSS data unavailable but attack vector is network-accessible with no complexity (CVSS 4.0 AV:N/AC:L/PR:N), making this a critical priority for any UltraDAG deployment using smart account pockets.

Server-side authentication bypass in the OpenTelemetry Collector Contrib azureauthextension (v0.124.0-v0.150.0) lets any holder of a valid Azure access token minted for the collector's service principal authenticate to any receiver configured with auth: azure_auth. The extension never validates bearer tokens as JWTs; it mints its own token using the client-supplied Host header as the scope and compares strings, so a token issued for an unrelated Azure resource (ARM, Graph, Key Vault, Storage) is accepted if the attacker sets a matching Host. No CISA KEV listing and EPSS is very low (0.05%), but the vendor advisory (GHSA-pjv4-3c63-699f) documents a working proof-of-concept for both replay and scope-confusion variants.

Authenticated attackers can read vault documentation from unauthorized vaults in Devolutions Server 2026.1.14.0 and earlier by sending a crafted API request that bypasses authorization checks on the vault documentation feature. The flaw stems from CWE-862 (Missing Authorization), where the server fails to verify that the requesting user has permission to access documentation tied to a specific vault. EPSS is 0.03% (8th percentile) and SSVC reports no known exploitation, indicating this is currently a theoretical risk with no observed active use.

OpenBao's Certificate authentication method with disable_binding=true allows token renewal using any sibling certificate signed by the same CA, rather than requiring the original certificate, enabling attackers with knowledge of a token or accessor to extend dynamic lease lifetimes beyond intended scope. The vulnerability affects OpenBao versions prior to 2.5.3 and requires high privileges and user interaction, resulting in a CVSS 2.0 score with low confidentiality and integrity impact. No public exploit code or active exploitation has been identified.

OpenBao 2.5.2 and earlier fails to properly quote PostgreSQL schema names during role revocation in the PostgreSQL database secrets engine, allowing authenticated high-privilege administrators to execute arbitrary SQL injection as the database management user. The vulnerability affects the credentials management workflow when revoking database roles, potentially compromising database integrity. A vendor-released patch (version 2.5.3) is available.

HashiCorp Vault unauthenticated denial-of-service vulnerability allows remote attackers to block critical administrative operations by monopolizing the single operation slot for root token generation and rekey workflows. Affects all Vault Community and Enterprise versions prior to 2.0.0. No active exploitation confirmed (EPSS 3rd percentile), but attack is trivially automatable per CISA SSVC framework. HashiCorp released patches in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0.

Token leakage in HashiCorp Vault and Vault Enterprise (0.11.2 up to 2.0.0, 1.21.5, 1.20.10, and 1.19.16) occurs when an auth mount is configured to pass through the 'Authorization' header and that same header is used to authenticate to Vault; in this case Vault forwards the caller's Vault token onward to the auth plugin backend. An authenticated client's token is thereby exposed to a plugin backend that should never see it, enabling potential impersonation and unauthorized secret access. No public exploit identified at time of analysis, and EPSS exploitation probability is negligible (0.01%, 3rd percentile).