CVE-2026-5051

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-5051
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5051.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-5051
Aliases
Published
2026-07-01T17:10:56.918Z
Modified
2026-07-15T01:49:09.539566124Z
Severity
  • 4.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Audit Log Plugin Directory Guard Bypass via Legacy path Option
Details

HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used.

This vulnerability (CVE-2026-5051) is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5051.json",
    "cna_assigner": "HashiCorp"
}
References

Affected packages

Git / github.com/hashicorp/vault

Affected ranges

Type
GIT
Repo
https://github.com/hashicorp/vault
Events
Introduced
b403b1a27c8db6038ffefb296d7be0962e08039d
Fixed
1a56927a170e2c67fa60a71158a3607d072a58a7
Introduced
7eeafb6160d60ede73c1d95566b0c8ea54f3cb5a
Fixed
1a56927a170e2c67fa60a71158a3607d072a58a7
Database specific 
{
    "extracted_events": [
        {
            "introduced": "1.20.1"
        },
        {
            "fixed": "2.0.1"
        },
        {
            "introduced": "1.19.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5051.json"