HashiCorp Tooling
13 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-110720 | 0.42.0 – < 2.0.4 | Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules | CRITICAL 9.9 | 0.4 % | ||
| CVE-2026-87993 | 0.27.2 – < 0.43.0 | Consul-template vulnerable to an information disclosure issue in error handling | HIGH 7.7 | 0.4 % | ||
| CVE-2026-8715 | 1.3.0 – < 1.5.0 | Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath | CRITICAL 9.6 | 0.5 % | ||
| CVE-2026-16326 | 0.1.0 – < 0.1.4 | consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode | CRITICAL 10.0 | 0.5 % | ||
| CVE-2026-16328 | 0.1.0 – < 0.1.4 | consul-mcp-server vulnerable to server side request forgery leading to token exposure | HIGH 8.6 | 0.4 % | ||
| CVE-2026-16498 | 0.3.0 – < 1.1.0 | terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode | CRITICAL 10.0 | 0.5 % | ||
| CVE-2026-16496 | 0.3.0 – < 1.1.0 | terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user | HIGH 8.9 | 0.4 % | ||
| CVE-2026-14869 | 0.3.0 – < 1.1.0 | terraform-mcp-server vulnerable to server side request forgery leading to token exposure | HIGH 8.6 | 0.4 % | ||
| CVE-2026-14361 | 0.1.0 – < 0.42.1 | Consul-template is vulnerable to path redirection in writeToFile through symlink attack | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-5061 | 0.1.0 – < 0.42.0 | Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack | MEDIUM 4.7 | 0.2 % | ||
| CVE-2026-4660 | < 1.8.6 | Go-getter may allow to arbitrary filesystem reads through git operations | HIGH 7.5 | 0.6 % | ||
| CVE-2025-13357 | 4.2.0 – < 5.5.0 | Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method | CRITICAL 9.8 | 0.5 % | ||
| CVE-2025-1293 | < 0.5.0 | HashiCorp Hermes Improperly Validates AWS ALB JWTs, which May Lead to Authentication Bypass | HIGH 8.2 | 0.3 % |