CVE-2026-5051 — Audit Log Plugin Directory Guard Bypass via Legacy path Option

CVE-2026-5051

Audit Log Plugin Directory Guard Bypass via Legacy path Option PUBLISHED

Description (CNA)

HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used. This vulnerability (CVE-2026-5051) is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17.

Affected (CNA)

Vendor / product	Versions
HashiCorp / Vault	affected 1.20.1 before 2.0.1
HashiCorp / Vault Enterprise	affected 1.19.0 before 2.0.1

CWE

CWE-22

References

https://discuss.hashicorp.com/t/hcsec-2026-16-vault-audit-device-plugin-directory-guard-bypass-via-legacy-path-option/77536

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.