HashiCorp security advisory (AV26-363)

Serial number: AV26-363
Date: April 17, 2026

On April 16, 2026, HashiCorp published security advisories to address vulnerabilities in the following products:

• Vault Community Edition – multiple versions
• Vault Enterprise Edition – multiple versions

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• HCSEC-2026-05 - Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service
• HCSEC-2026-06 - Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS
• HashiCorp Security