CVE-2026-105816

Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots

State: Published
Severity: 8.0 High
Published: Oct 7, 2026
Updated: Oct 9, 2026
Reserved: Oct 5, 2026

Description

Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory configured, a privileged operator able to restore an Integrated Storage (Raft) snapshot may be able to execute arbitrary code on the Vault host. This vulnerability (CVE-2026-105816) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.

Scores

CVSS	Score	Vector	Source
3.1	8.0 High	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H	HashiCorp

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)

Affected Products

Product	Versions
VaultHashiCorp	0.0.1 to before 2.1.2Affected
Vault EnterpriseHashiCorp	0.0.1 to before 2.1.2Affectedfrom 1.21.12Not affectedfrom 1.20.17Not affectedfrom 1.19.23Not affected

References

https://discuss.hashicorp.com/t/hcsec-2026-41-vault-vulnerable-to-arbitrary-code-execution-via-plugin-catalog-entries-restored-from-raft-snapshots/77813

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.