CVE-2026-105816: 
HashiCorp Vault vulnerability analysis and mitigation

CVE-2026-105816 is an arbitrary code execution vulnerability in HashiCorp Vault and Vault Enterprise caused by insufficient verification of plugin catalog entries during Integrated Storage (Raft) snapshot restoration. When Vault is configured with Shamir seals and an external plugin directory, a privileged operator who can restore a Raft snapshot may execute arbitrary code on the Vault host. The vulnerability affects all versions from 0.0.1 up to (but not including) 2.1.2 for both Vault Community Edition and Vault Enterprise. It was disclosed on October 7, 2026, and carries a CVSS v3.1 base score of 8.0 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). Vault failed to consistently validate that plugin catalog entries stored in Integrated Storage (Raft) point only to binaries within the designated plugin directory. An attacker who can craft or tamper with a Raft snapshot can embed plugin catalog entries referencing arbitrary binaries outside the plugin directory; when the snapshot is restored on a Vault instance using Shamir seals with an external plugin directory configured, those entries are loaded and executed without proper path boundary enforcement. Exploitation requires high privileges (the ability to perform snapshot restoration) and high attack complexity, but no user interaction, and the scope change indicates impact can extend beyond the Vault process itself (Github Advisory, Red Hat Bugzilla).

Successful exploitation allows a privileged operator to execute arbitrary code on the Vault host system, resulting in complete compromise of confidentiality, integrity, and availability. Because Vault typically stores sensitive secrets, credentials, and cryptographic material, arbitrary code execution on the host could expose all secrets managed by the instance, enable lateral movement to dependent systems, and allow persistent backdoor installation. The CVSS scope change indicates that the impact can extend beyond the Vault application boundary to the underlying host and connected infrastructure (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Github Advisory). The NVD SSVC assessment confirms exploitation status as "none" and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.335%, indicating a low near-term probability of exploitation. Exploitation is constrained by the requirement for high privileges (snapshot restoration capability) and a specific Vault configuration (Shamir seals with an external plugin directory), significantly limiting the attacker pool.

1. Identify target configuration: Confirm the target Vault instance uses Shamir seals and has an external plugin directory configured — both conditions are required for exploitation.
2. Obtain privileged access: Acquire credentials or tokens with sufficient privileges to perform Integrated Storage (Raft) snapshot operations (typically requires operator-level access).
3. Obtain or create a malicious Raft snapshot: Craft or modify a Raft snapshot to include plugin catalog entries that reference arbitrary binaries outside the configured plugin directory, exploiting the path traversal weakness (CWE-22).
4. Restore the malicious snapshot: Use the Vault API or CLI (vault operator raft snapshot restore) to restore the tampered snapshot to the target Vault instance.
5. Trigger plugin execution: Cause Vault to load or invoke the maliciously registered plugin catalog entry, resulting in execution of the attacker-controlled binary on the Vault host with the privileges of the Vault process (Github Advisory, Red Hat Bugzilla).

• Logs: Vault audit logs showing vault operator raft snapshot restore operations performed by unexpected or unauthorized operators; plugin registration or catalog update events referencing paths outside the configured plugin directory.
• File System: Unexpected binaries or executables appearing outside the designated Vault plugin directory; new files created in sensitive system directories with timestamps correlating to snapshot restoration events.
• Process: Unusual child processes spawned by the Vault process (e.g., shells, network utilities, or unknown binaries); processes running under the Vault service account that are not part of normal Vault operation.
• Network: Unexpected outbound connections from the Vault host to external IPs following a snapshot restoration event, potentially indicating reverse shell or data exfiltration activity.

HashiCorp has released patched versions that fix this vulnerability: Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Organizations should upgrade to one of these versions as the primary remediation. As interim mitigations: restrict access to Raft snapshot restoration operations to the minimum number of trusted personnel; audit existing plugin catalog entries to ensure all referenced binaries reside within the configured plugin directory; and monitor Vault audit logs for unauthorized snapshot restoration activity (Github Advisory, HashiCorp Advisory).

HashiCorp published an official security advisory (HCSEC-2026-41) disclosing the vulnerability and providing patched versions (HashiCorp Advisory). Red Hat tracked the issue via Bugzilla for potential impact on their product offerings (Red Hat Bugzilla). No significant independent researcher commentary or notable social media discussion has been observed beyond standard vulnerability aggregator coverage.