CVE-2026-4525
Full vulnerability record from the local CVENow database.
Description
If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
Severity
HIGH
CVSS score
8.8
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2026-04-17 04:16:09.997000
Last modified
2026-10-25 23:10:00.167000
View original CVE JSON
{
"id": "CVE-2026-4525",
"sourceIdentifier": "[email protected]",
"published": "2026-04-17T04:16:09.997",
"lastModified": "2026-10-25T23:10:00.167",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "If a Vault auth mount is configured to pass through the \"Authorization\" header, and the \"Authorization\" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16."
},
{
"lang": "es",
"value": "Si un montaje de autenticación de Vault está configurado para pasar el encabezado ’Authorization’, y el encabezado ’Authorization’ se utiliza para autenticarse en Vault, Vault reenvió el token de Vault al backend del plugin de autenticación. Corregido en 2.0.0, 1.21.5, 1.20.10 y 1.19.16."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "HashiCorp",
"product": "Vault",
"defaultStatus": "unaffected",
"platforms": [
"64 bit",
"32 bit",
"x86",
"ARM",
"MacOS",
"Windows",
"Linux"
],
"repo": "https://github.com/hashicorp/vault",
"versions": [
{
"version": "0.11.2",
"lessThan": "2.0.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "HashiCorp",
"product": "Vault Enterprise",
"defaultStatus": "unaffected",
"platforms": [
"64 bit",
"32 bit",
"x86",
"ARM",
"MacOS",
"Windows",
"Linux"
],
"repo": "https://github.com/hashicorp/vault",
"versions": [
{
"version": "0.11.2",
"lessThan": "2.0.0",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "1.19.16",
"status": "unaffected"
},
{
"at": "1.20.10",
"status": "unaffected"
},
{
"at": "1.21.5",
"status": "unaffected"
}
]
}
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift4/ose-baremetal-installer-rhel9",
"cpes": [
"cpe:/a:redhat:openshift:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift4/ose-installer-rhel9",
"cpes": [
"cpe:/a:redhat:openshift:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Openshift Data Foundation 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cephcsi-rhel8",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Openshift Data Foundation 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cephcsi-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Openshift Data Foundation 4",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "mcg-cli-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Openshift Data Foundation 4",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "mcg-rhel8-operator",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Openshift Data Foundation 4",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "mcg-rhel9-operator",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Openshift Data Foundation 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ocs4/cephcsi-rhel8",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Openshift Data Foundation 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "odf4/cephcsi-rhel8",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Openshift Data Foundation 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "odf4/cephcsi-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Openshift Data Foundation 4",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "odf4/mcg-cli-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Openshift Data Foundation 4",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "odf4/mcg-rhel8-operator",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Openshift Data Foundation 4",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "odf4/mcg-rhel9-operator",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.6,
"impactScore": 5.9
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.6,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-17T13:19:26.452614Z",
"id": "CVE-2026-4525",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-201"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-201"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "0.11.2",
"versionEndExcluding": "1.19.16",
"matchCriteriaId": "E12BA6D9-0FDE-4CA9-8D01-35CD029D15D2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
"versionStartIncluding": "0.11.2",
"versionEndExcluding": "2.0.0",
"matchCriteriaId": "48995D65-70D6-476A-ACD7-2A8F527D2975"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "1.20.0",
"versionEndExcluding": "1.20.10",
"matchCriteriaId": "E2135CCF-F6D8-41AC-8D0C-F763F63974B4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "1.21.0",
"versionEndExcluding": "1.21.5",
"matchCriteriaId": "C8097BD2-0B19-4BA7-930E-93A5A89EC4AF"
}
]
}
]
}
],
"references": [
{
"url": "https://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-4525",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459107",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4525.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
]
}