HashiCorp Tooling

• CVE-2026-110720 Critical 9.9 Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules 0.4%
• CVE-2026-87993 High 7.7 Consul-template vulnerable to an information disclosure issue in error handling 0.4%
• CVE-2026-8715 Critical 9.6 Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath 0.5%
• CVE-2026-16326 Critical 10.0 consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode 0.5%
• CVE-2026-16328 High 8.6 consul-mcp-server vulnerable to server side request forgery leading to token exposure 0.4%
• CVE-2026-16498 Critical 10.0 terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode 0.5%
• CVE-2026-16496 High 8.9 terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user 0.4%
• CVE-2026-14869 High 8.6 terraform-mcp-server vulnerable to server side request forgery leading to token exposure 0.4%
• CVE-2026-14361 Medium 4.7 Consul-template is vulnerable to path redirection in writeToFile through symlink attack 0.1%
• CVE-2026-5061 Medium 4.7 Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack 0.2%
• CVE-2026-4660 High 7.5 Go-getter may allow to arbitrary filesystem reads through git operations 0.6%
• CVE-2025-13357 High 7.4 Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method 0.5%
• CVE-2025-1293 High 8.2 HashiCorp Hermes Improperly Validates AWS ALB JWTs, which May Lead to Authentication Bypass 0.3%