CVE-2026-5052: Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS
Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5052?
CVE-2026-5052 is considered a high-severity vulnerability due to the potential for server-side request forgery attacks.
How do I fix CVE-2026-5052?
To fix CVE-2026-5052, upgrade to Vault version 2.0.0 or later, or apply any available patches recommended by HashiCorp.
Which versions of Vault are affected by CVE-2026-5052?
Vault Community Edition versions prior to 2.0.0 and Vault Enterprise versions up to 2.0.0, 1.21.5, 1.20.10, and 1.19.16 are affected by CVE-2026-5052.
What are the potential impacts of CVE-2026-5052?
The potential impacts of CVE-2026-5052 include exposing local network targets to unauthorized requests through server-side request forgery.
Who is responsible for addressing CVE-2026-5052?
The responsibility for addressing CVE-2026-5052 lies with administrators of affected Vault installations, who should implement recommended updates.