HashiCorp security bulletins
Printed in Security Desk · discuss.hashicorp.com
Publishes about 2 a week · last piece Oct 13, 2026
How often
about 2 a week, by the archive: 11 pieces since Sep 10, 2026.
12 weeks agothis week
Latest pieces
- HCSEC-2026-45 - Updates to HashiCorp subprocessors
- HCSEC-2026-44 - Go-getter vulnerable to a path traversal in S3/GCS directory download handling
- HCSEC-2026-43 - Vault Inconsistent ACL Policy Evaluation May Allow Bypass of Deny Restrictions
- HCSEC-2026-42 - Vault Enterprise ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution
- HCSEC-2026-41 - Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots
- HCSEC-2026-40 - Vault PKI ACME Default Directory Policy May Issue Certificates With Unverified Identities
- HCSEC-2026-39 - Go-getter vulnerable to a privilege escalation issue in its archive decompression handling
- HCSEC-2026-38 - Consul-template vulnerable to an information disclosure issue in error handling
- HCSEC-2026-37 - Consul vulnerable to an authorization bypass in the Connect service mesh
- HCSEC-2026-36 - Consul vulnerable to an authorization bypass in the catalog deregistration path
- HCSEC-2026-35 - Consul vulnerable to a denial of service in the native RPC listener
In these topics
Pick one in My Edition to read it with its neighbors.