CVE-2026-5052

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-5052
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5052.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-5052
Aliases
Downstream
Related
Published
2026-04-17T02:55:25.080Z
Modified
2026-07-15T01:49:12.099985352Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS
Details

Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

Database specific 
{
    "cna_assigner": "HashiCorp",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5052.json"
}
References

Affected packages

Git / github.com/hashicorp/vault

Affected ranges

Type
GIT
Repo
https://github.com/hashicorp/vault
Events
Introduced
b4d07277a6c5318bb50d3b94bbd6135dccb4c601
Fixed
cf1ce4df8af6e323558bd5f8c37e771388cbc951
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "1.15.0"
        },
        {
            "fixed": "2.0.0"
        },
        {
            "introduced": "1.14.0"
        }
    ],
    "cpe": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5052.json"