Security Advisory

CVE-2026-5052

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-04-17 02:55:25

Last updated 2026-04-17 17:57:55

Assigner HashiCorp

CVSS score 5.3

State PUBLISHED

Description

Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

← Browse all CVEs View on cve.org ↗