Tooling
Monthly
Vault secret values leak into error messages, log output, and Nomad task events in HashiCorp consul-template due to improper error handling. The vulnerability affects consul-template deployments integrated with HashiCorp Vault, where a template rendering error can inadvertently expose secret values to any downstream surface that receives error text - including Nomad task event logs readable by lower-privileged operators. The scope-changed CVSS vector (S:C) reflects that the primary harm falls on systems outside consul-template itself: Vault secrets meant to be accessed only by privileged services instead persist in Nomad task events and logging infrastructure accessible to broader audiences.
Arbitrary file read in HashiCorp Vault Secrets Operator versions 1.3.0 through 1.4.1 lets a low-privileged Kubernetes tenant abuse the AppRole authentication's SecretIDPath configuration to read files from the operator pod's filesystem and exfiltrate their contents to an attacker-controlled endpoint, enabling privilege escalation across the cluster. Because the operator pod typically holds credentials and tokens spanning multiple tenants, a single limited-RBAC tenant can cross trust boundaries (CVSS scope change), yielding a 9.6 rating. No public exploit identified at time of analysis, but the low attack complexity and multi-tenant blast radius make this a high-priority patch.
Cross-session token leakage in HashiCorp consul-mcp-server 0.1.0 through 0.1.3 allows one client's Consul authentication token to bleed into requests issued by other clients when the server runs in stateless mode, effectively enabling an attacker to act against Consul with a victim's credentials. HashiCorp rated this CVSS 10.0 (scope-changed) because the borrowed token grants the attacker the victim's full Consul read/write authority across a trust boundary. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix is consul-mcp-server 0.1.4.
Server-Side Request Forgery in HashiCorp's consul-mcp-server 0.1.0 through 0.1.3 lets a connected client override the server's configured Consul backend address through an untrusted request header, redirecting the server's Consul API calls to an attacker-controlled endpoint and exfiltrating the privileged Consul token held by the server. The flaw carries a CVSS 8.6 (scope-changed, high confidentiality impact) and is fixed in 0.1.4; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Credential reuse in Terraform MCP Server allows cross-tenant token leakage, enabling unauthorized tool execution on behalf of other users. The vulnerability affects versions prior to 1.1.0 when the server is run in streamable-HTTP stateless transport mode. No public exploit code is known, but the critical CVSS score and network attack vector indicate high potential risk.
Authorization bypass in HashiCorp's terraform-mcp-server (versions 0.3.0 through 1.0.x) lets an attacker who obtains another user's MCP session identifier execute their own tool calls under the victim's Terraform credentials when the server runs in streamable-HTTP stateful transport mode. Rooted in a session fixation weakness (CWE-384), the flaw carries a CVSS 8.9 with a scope change, meaning cross-user credential misuse against managed infrastructure. No public exploit identified at time of analysis; EPSS is low (0.27%) and CISA SSVC records exploitation as none, indicating no observed active exploitation.
Server-side request forgery in HashiCorp terraform-mcp-server before 1.1.0 allows unauthenticated remote attackers to redirect Terraform API requests and steal server-side authorization tokens via the streamable-HTTP transport. The vulnerability, tracked as CVE-2026-14869, permits an attacker to control the destination of outbound requests, leading to token exposure. No public exploit or active exploitation has been reported at this time.
Arbitrary file read vulnerability in HashiCorp go-getter library versions up to 1.8.5 enables unauthenticated remote attackers to access sensitive files from the target filesystem through specially crafted git operation URLs. The vulnerability permits confidentiality breach without authentication requirements, affecting network-accessible services utilizing the library for repository cloning or fetching operations. Fixed in version 1.8.6; go-getter/v2 branch unaffected. No public exploit identified at time of analysis.
Sandbox path bypass in consul-template before 0.42.0 allows local authenticated users to read files outside the intended sandbox via symlink attack in the file template helper. The vulnerability requires local access and elevated privileges but grants high confidentiality impact. Vendor-released patch available in version 0.42.0.
Vault secret values leak into error messages, log output, and Nomad task events in HashiCorp consul-template due to improper error handling. The vulnerability affects consul-template deployments integrated with HashiCorp Vault, where a template rendering error can inadvertently expose secret values to any downstream surface that receives error text - including Nomad task event logs readable by lower-privileged operators. The scope-changed CVSS vector (S:C) reflects that the primary harm falls on systems outside consul-template itself: Vault secrets meant to be accessed only by privileged services instead persist in Nomad task events and logging infrastructure accessible to broader audiences.
Arbitrary file read in HashiCorp Vault Secrets Operator versions 1.3.0 through 1.4.1 lets a low-privileged Kubernetes tenant abuse the AppRole authentication's SecretIDPath configuration to read files from the operator pod's filesystem and exfiltrate their contents to an attacker-controlled endpoint, enabling privilege escalation across the cluster. Because the operator pod typically holds credentials and tokens spanning multiple tenants, a single limited-RBAC tenant can cross trust boundaries (CVSS scope change), yielding a 9.6 rating. No public exploit identified at time of analysis, but the low attack complexity and multi-tenant blast radius make this a high-priority patch.
Cross-session token leakage in HashiCorp consul-mcp-server 0.1.0 through 0.1.3 allows one client's Consul authentication token to bleed into requests issued by other clients when the server runs in stateless mode, effectively enabling an attacker to act against Consul with a victim's credentials. HashiCorp rated this CVSS 10.0 (scope-changed) because the borrowed token grants the attacker the victim's full Consul read/write authority across a trust boundary. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix is consul-mcp-server 0.1.4.
Server-Side Request Forgery in HashiCorp's consul-mcp-server 0.1.0 through 0.1.3 lets a connected client override the server's configured Consul backend address through an untrusted request header, redirecting the server's Consul API calls to an attacker-controlled endpoint and exfiltrating the privileged Consul token held by the server. The flaw carries a CVSS 8.6 (scope-changed, high confidentiality impact) and is fixed in 0.1.4; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Credential reuse in Terraform MCP Server allows cross-tenant token leakage, enabling unauthorized tool execution on behalf of other users. The vulnerability affects versions prior to 1.1.0 when the server is run in streamable-HTTP stateless transport mode. No public exploit code is known, but the critical CVSS score and network attack vector indicate high potential risk.
Authorization bypass in HashiCorp's terraform-mcp-server (versions 0.3.0 through 1.0.x) lets an attacker who obtains another user's MCP session identifier execute their own tool calls under the victim's Terraform credentials when the server runs in streamable-HTTP stateful transport mode. Rooted in a session fixation weakness (CWE-384), the flaw carries a CVSS 8.9 with a scope change, meaning cross-user credential misuse against managed infrastructure. No public exploit identified at time of analysis; EPSS is low (0.27%) and CISA SSVC records exploitation as none, indicating no observed active exploitation.
Server-side request forgery in HashiCorp terraform-mcp-server before 1.1.0 allows unauthenticated remote attackers to redirect Terraform API requests and steal server-side authorization tokens via the streamable-HTTP transport. The vulnerability, tracked as CVE-2026-14869, permits an attacker to control the destination of outbound requests, leading to token exposure. No public exploit or active exploitation has been reported at this time.
Arbitrary file read vulnerability in HashiCorp go-getter library versions up to 1.8.5 enables unauthenticated remote attackers to access sensitive files from the target filesystem through specially crafted git operation URLs. The vulnerability permits confidentiality breach without authentication requirements, affecting network-accessible services utilizing the library for repository cloning or fetching operations. Fixed in version 1.8.6; go-getter/v2 branch unaffected. No public exploit identified at time of analysis.
Sandbox path bypass in consul-template before 0.42.0 allows local authenticated users to read files outside the intended sandbox via symlink attack in the file template helper. The vulnerability requires local access and elevated privileges but grants high confidentiality impact. Vendor-released patch available in version 0.42.0.