CVE-2026-93333: Vault audit device prefix vulnerable to log injection
Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading audit records. This vulnerability (CVE-2026-93333) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vault Community Edition and Vault Enterpriseto a version that resolves this vulnerability.Fixed in 2.2.2 - Upgrade
Upgrade
Vault Enterpriseto a version that resolves this vulnerability.Fixed in 1.21.14 - Upgrade
Upgrade
Vault Enterpriseto a version that resolves this vulnerability.Fixed in 1.19.25
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires a privileged operator who can configure an audit log prefix. The issue does not describe an unauthenticated or low-privileged attack path.
Which deployments need remediation?
Vault Community Edition versions before 2.2.2 are affected. Vault Enterprise is fixed in 2.2.2, 1.21.14, and 1.19.25; Enterprise deployments should use the applicable fixed release line.
What is the impact of successful exploitation?
A privileged operator may inject content into audit logs, which can create forged or misleading audit records. The provided severity vector indicates integrity impact only, with no stated confidentiality or availability impact.