CVE-2026-5051: HashiCorp Vault Audit Device Path Validation Flaw

Technical summary

CVE-2026-5051 involves improper path traversal protection (CWE-22) in Vault's audit device validation logic. When the legacy file audit path option is configured, the system fails to consistently enforce plugin directory restrictions, potentially permitting directory traversal attacks. The vulnerability is reachable only by authenticated users with elevated privileges and carries a CVSS 3.1 score of 4.4 (Medium severity) reflecting high confidentiality impact but no availability or integrity risk.

Business impact

Organizations running affected Vault versions face a controlled but real risk of unauthorized information disclosure. An insider or compromised administrator account could potentially access sensitive audit data or other protected files outside the intended audit directory. For firms relying on Vault as a secrets management backbone, this represents a compliance and data protection concern, particularly in regulated industries where audit trail integrity and separation of duties are critical controls.

Affected systems

HashiCorp Vault and Vault Enterprise versions prior to 2.0.1 are affected, specifically versions before 2.0.1, 1.21.6, 1.20.11, and 1.19.17. Organizations should verify their deployed version against the vendor advisory to determine exposure. Note that the legacy file audit path feature must be in active use for this vulnerability to be exploitable.

Exploitability

Exploitation requires high-privilege (administrative) access to Vault and manual configuration of the legacy file audit path option. The attack complexity is high, meaning an attacker must satisfy specific conditions. This is not a remote unauthenticated vulnerability; it is restricted to authorized users with role-based permissions. No public exploits or active in-the-wild activity has been confirmed.

Remediation

Update to patched versions: 2.0.1 or later, 1.21.6 or later, 1.20.11 or later, or 1.19.17 or later. Organizations unable to upgrade immediately should audit configuration to determine if the legacy file audit path feature is enabled and, if so, consider restricting who has permission to modify audit device settings. Review Vault access logs for any suspicious administrative activity targeting audit configurations.

Patch guidance

Apply the latest patch version matching your release train (2.0.x, 1.21.x, 1.20.x, or 1.19.x). Verify the patch version against HashiCorp's official security advisory before deployment. Test in a non-production environment first, particularly if you are using custom audit backends. No breaking changes are documented in the security fix, but review your specific deployment configuration to ensure audit functionality remains intact post-patch.

Detection guidance

Monitor Vault audit logs for changes to audit device configurations, particularly modifications to file path settings. Review administrative access to the sys/audit endpoint and look for any attempts to manipulate plugin directory paths. If the legacy file audit path feature is in use, audit file permissions and ownership to detect unauthorized access attempts. Network-level detection is limited since this requires authenticated API calls; focus on application-level logging and access control validation.

Why prioritize this

Although classified as Medium severity, this vulnerability warrants prompt attention for any organization with strict audit and compliance requirements. The fact that it targets audit trail integrity—a fundamental control objective—elevates its importance beyond the raw CVSS score. Organizations in regulated sectors (finance, healthcare, government) should prioritize patching. The requirement for admin-level access limits urgency for firms with strong PAM and role-based access controls, but it should not be deferred.

Risk score, explained

CVSS 3.1 score of 4.4 reflects high confidentiality impact (an attacker can read sensitive data) but is constrained by the requirement for network access, high attack complexity, and high privilege level. The score appropriately captures that while the vulnerability is real and affects a critical system component (audit), it is not trivial to exploit in practice. Context matters: a firm with weak administrative access controls faces higher risk than one with mature identity governance.

Frequently asked questions