CVE-2026-5052 Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS

What is CVE-2026-5052?

CVE-2026-5052 is a medium-severity server-side request forgery vulnerability in Hashicorp Vault, published on 17 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

Weakness: CWE-918

Which versions are affected by CVE-2026-5052?

4 open source packages ship an affected version, including github.com/hashicorp/vault and vault. It affects 1 product.

Products include Hashicorp Vault.

How do I fix CVE-2026-5052?

Upgrade to a fixed version.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-5052 being exploited?

There is no known exploitation of CVE-2026-5052 in the wild and no public exploit code.

Other vulnerabilities in Hashicorp Vault

• CVE-2020-35192 Hardcoded credentials in n/a Critical 9.8
• CVE-2020-12757 Improper Input Validation in HashiCorp Vault Critical 9.8
• CVE-2025-6000 Arbitrary Remote Code Execution via Plugin Catalog Abuse Critical 9.1
• CVE-2022-40186 HashiCorp Vault vulnerable to incorrect metadata access Critical 9.1
• CVE-2022-36129 Missing authorization in n/a Critical 9.1

All Hashicorp Vault vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-vault-2026-5052, GHSA-8r5m-3f66-qpr3, GO-2026-5262, MINI-264j-j2wq-x5rm, MINI-fxqj-6w68-xxfj.