CVE-2026-92735: Vault integrated storage join may disclose server environment credentials

Published Nov 12, 2026

Updated

HashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow an unauthenticated attacker with network access to a new, uninitialized node to cause that node to send credentials from its server environment to an attacker-controlled server. This vulnerability (CVE-2026-92735) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade HashiCorp Vault Community Edition to a version that resolves this vulnerability.
Fixed in 2.2.2
Upgrade
Upgrade HashiCorp Vault Enterprise to a version that resolves this vulnerability.
Fixed in 2.2.2
Upgrade
Upgrade HashiCorp Vault Enterprise to a version that resolves this vulnerability.
Fixed in 1.21.14
Upgrade
Upgrade HashiCorp Vault Enterprise to a version that resolves this vulnerability.
Fixed in 1.19.25

Event History

Nov 12, 2026

CVE Published

via MITRE·10:31 PM

Data Sourced

via MITRE·10:31 PM

DescriptionSeverityWeakness

Nov 13, 2026

Data Sourced

via NVD·12:20 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which systems are exposed to this issue?

The affected scenario involves a new, uninitialized Vault node using the integrated storage join process. An attacker must have network access to that node.

Does exploitation require Vault authentication or user interaction?

No. The vulnerability can be exploited by an unauthenticated attacker, and no user interaction is required.

Which versions contain the fix?

The issue is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.