CVE catalog

CVE-2026-4525

If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin back

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.41% · Oct 25, 2026

If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpevaultNot reported1.19.16fixed
CpevaultNot reported2.0.0fixed
CpevaultNot reported1.20.10fixed
CpevaultNot reported1.21.5fixed
CpevaultNot reported1.21.5fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpevaultcpeNot reported1.19.16Not reportedNot reportedNot reported
CpevaultcpeNot reported2.0.0Not reportedNot reportedNot reported
CpevaultcpeNot reported1.20.10Not reportedNot reportedNot reported
CpevaultcpeNot reported1.21.5Not reportedNot reportedNot reported
CpevaultcpeNot reported1.21.5Not reportedNVD-CVE-2026-4525Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]