Server-Side Request Forgery (SSRF) in Vault Enterprise and Vault - CVE-2026-5052
Published: April 17, 2026
Vulnerability identifier: #VU126410
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-5052
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper restriction of server-side request targets in the PKI engine ACME challenge validation when issuing http-01 and tls-alpn-01 challenges using attacker-controlled DNS. A remote attacker can cause Vault to send challenge validation requests to local network targets to disclose sensitive information.
Depending on the Vault configuration, the challenge endpoint is either unauthenticated or requires an EAB token.
Affected software
Vault Enterprise
Vault
Vault
How to mitigate CVE-2026-5052
Install security update from vendor's website.
Vault Enterprise - addressed in versions 1.19.16, 1.20.10, 1.21.5, 2.0.0
Vault - update to 2.0.0
Vault - update to 2.0.0