BIT-vault-2026-5051

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/vault/BIT-vault-2026-5051.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-vault-2026-5051
Aliases
Published
2026-07-07T08:54:58.835Z
Modified
2026-07-07T09:15:05.055428858Z
Summary
Audit Log Plugin Directory Guard Bypass via Legacy path Option
Details

HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used.

This vulnerability (CVE-2026-5051) is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17.

Database specific 
{
    "severity": "Medium",
    "cpes": [
        "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:go:*:*",
        "cpe:2.3:a:hashicorp:vault:*:*:*:*:community:go:*:*"
    ]
}
References

Affected packages

Bitnami / vault

Package

Name
vault
Purl
pkg:bitnami/vault

Severity

  • 4.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
1.19.0
Fixed
1.19.17
Introduced
1.20.0
Fixed
1.20.11
Introduced
1.21.0
Fixed
1.21.6
Introduced
2.0.0
Fixed
2.0.1

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/vault/BIT-vault-2026-5051.json"