CVE catalog

CVE-2026-5052

Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially lead

[CVE catalog]

Severity
Medium · CVSS 5.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.34% · Oct 25, 2026

Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpevaultNot reported1.19.16fixed
CpevaultNot reported2.0.0fixed
CpevaultNot reported1.20.10fixed
CpevaultNot reported1.21.5fixed
CpevaultNot reported1.21.5fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpevaultcpeNot reported1.19.16Not reportedNot reportedNot reported
CpevaultcpeNot reported2.0.0Not reportedNot reportedNot reported
CpevaultcpeNot reported1.20.10Not reportedNot reportedNot reported
CpevaultcpeNot reported1.21.5Not reportedNot reportedNot reported
CpevaultcpeNot reported1.21.5Not reportedNVD-CVE-2026-5052Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]