CVE-2026-105818: Vault PKI ACME Issues Certificate With Unvalidated SANs

Q: Which deployments are exposed?

Deployments using the Vault PKI secrets engine ACME server under the default directory policy are affected. The practical risk applies where systems trust certificates issued by the affected Vault PKI mount.

Q: What does an attacker need to exploit this issue?

An attacker needs to act as an ACME client against the affected PKI mount. No privileges or user interaction are indicated, but the attack complexity is rated high.

Q: What is the impact of a successful exploit?

An attacker may obtain a certificate containing identity claims that were not validated by ACME challenges. This could enable impersonation to systems that trust certificates from the affected mount.

Q: Which versions contain fixes?

Fixed versions are Vault Community Edition 2.1.2 and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.

Published Oct 7, 2026

Updated

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling impersonation toward systems that trust certificates issued by the affected Vault PKI mount. This vulnerability (CVE-2026-105818) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.

Affected Software

2 affected components

HashiCorp Vault Community Edition<2.1.2

HashiCorp Vault Enterprise<2.1.2, <1.21.12, <1.20.17, <1.19.23

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Vault Community Edition to a version that resolves this vulnerability.
Fixed in 2.1.2
Upgrade
Upgrade Vault Enterprise to a version that resolves this vulnerability.
Fixed in 2.1.2
Upgrade
Upgrade Vault Enterprise to a version that resolves this vulnerability.
Fixed in 1.21.12
Upgrade
Upgrade Vault Enterprise to a version that resolves this vulnerability.
Fixed in 1.20.17
Upgrade
Upgrade Vault Enterprise to a version that resolves this vulnerability.
Fixed in 1.19.23

Event History

Oct 7, 2026

CVE Published

via MITRE·09:21 PM

Data Sourced

via MITRE·09:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments using the Vault PKI secrets engine ACME server under the default directory policy are affected. The practical risk applies where systems trust certificates issued by the affected Vault PKI mount.

What does an attacker need to exploit this issue?