Vulnerability · Published Apr 17, 2026 · Assigned by HashiCorp
CVE-2026-4525Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header
High 7.5
In plain English
A high-severity security flaw in Vault from HashiCorp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 65.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/hashicorp/vault | no fix listed | GHSA-72gw-fmmr-c4r4 |
| Go | github.com/hashicorp/vault | no fix listed | GO-2026-5199 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HashiCorp | Vault | 0.11.2 – before 2.0.0 |
| HashiCorp | Vault Enterprise | 0.11.2 – before 2.0.0 |
Weakness: CWE-201 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344
- https://access.redhat.com/security/cve/CVE-2026-4525 vdb-entry, x_refsource_REDHAT
- RHBZ#2459107 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4525.json x_sadp-csaf-vex