Security Advisory

CVE-2026-4525

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-04-17 03:00:47

Last updated 2026-07-15 00:52:47

Assigner HashiCorp

CVSS score 7.5

State PUBLISHED

Description

If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

← Browse all CVEs View on cve.org ↗