High severity · published Apr 17, 2026
CVE-2026-4525
Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VA
Vault · HashiCorp
0.11.2 before 2.0.0 · source: vendor, NVD
VE
Vault Enterprise · HashiCorp
0.11.2 before 2.0.0 · source: vendor
RH
Red Hat Openshift Data Foundation 4 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-4525
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-4525
Vendor Advisory
https://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-4525
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2459107
security.access.redhat.com
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4525.json
More from Vault
9.8
CVE-2024-2048
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate
9.8
CVE-2020-35192
The official vault docker images before 0.11.6 contain a blank password for a root user
9.8
CVE-2020-12757
HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease…
9.1
CVE-2025-6000
A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in…
9.1
CVE-2022-40186
An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3