CVE-2026-105818: 
HashiCorp Vault vulnerability analysis and mitigation

CVE-2026-105818 is a spoofing vulnerability in HashiCorp Vault's PKI secrets engine ACME server that allows an ACME client to obtain certificates containing unverified identity claims under the default directory policy. Affected versions span Vault Community Edition and Vault Enterprise from 1.14.0 up to (but not including) 2.1.2. The vulnerability was published on October 7, 2026, and patches were released the same day. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, HashiCorp Advisory).

The root cause is classified as CWE-345 (Insufficient Verification of Data Authenticity): Vault's PKI secrets engine ACME server failed to restrict certificate identities to only those validated by ACME challenges when operating under the default directory policy. In the ACME protocol, domain ownership is proven via challenges (e.g., HTTP-01, DNS-01); however, the affected Vault implementation did not enforce that all identity claims in a certificate signing request were covered by a successfully completed challenge. This means an ACME client could request a certificate including Subject Alternative Names (SANs) or other identity fields that were never verified, bypassing the intended trust model of the PKI mount (GitHub Advisory, HashiCorp Advisory).

Successful exploitation allows an unauthenticated ACME client to obtain a certificate from the Vault PKI mount that contains identity claims (e.g., domain names or other SANs) that were never actually verified. This enables impersonation of legitimate identities toward any system that trusts certificates issued by the affected Vault PKI mount, potentially facilitating man-in-the-middle attacks, service impersonation, or unauthorized access to TLS-protected resources. There is no confidentiality or availability impact; the primary risk is a high integrity impact through fraudulent certificate issuance (GitHub Advisory, HashiCorp Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.08%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity, as the attacker must interact with the ACME server and craft requests with unverified identity claims, though no authentication is required (GitHub Advisory, HashiCorp Advisory).

1. Reconnaissance: Identify Vault instances with the PKI secrets engine enabled and the ACME server accessible, running versions 1.14.0 through 2.1.2 (exclusive). Check if the ACME endpoint is reachable (e.g., https://<vault-host>/v1/<pki-mount>/acme/directory).
2. ACME Account Registration: Register an ACME account with the Vault PKI ACME server using a standard ACME client (e.g., certbot, acme.sh, or a custom client).
3. Order Certificate with Unverified Identities: Submit a certificate order that includes identity claims (SANs or other fields) beyond those that will be validated by the ACME challenge — for example, including additional domain names not controlled by the attacker.
4. Complete ACME Challenge for a Subset of Identities: Complete the ACME challenge (HTTP-01 or DNS-01) only for the identities the attacker controls, exploiting the server's failure to enforce challenge coverage for all requested identities.
5. Obtain Fraudulent Certificate: Finalize the order and download the issued certificate, which now contains unverified identity claims, enabling impersonation of those identities to relying parties that trust the Vault PKI mount (GitHub Advisory, HashiCorp Advisory).

• Logs: Vault audit logs showing ACME certificate orders finalized with SANs or identity fields that do not correspond to completed ACME challenges; review pki/acme/order and pki/acme/finalize log entries for mismatches between challenged and issued identities.
• Network: Unexpected ACME client connections to the Vault PKI ACME endpoint (/v1/<pki-mount>/acme/) from unknown or external IP addresses, particularly with certificate finalization requests containing multiple SANs.
• File System / Certificate Store: Presence of certificates issued by the Vault PKI mount containing SANs for domains or identities not expected to be served by that mount; audit issued certificate serial numbers against expected requestors.
• Vault PKI: Anomalous entries in the PKI secrets engine's issued certificate list (vault list <pki-mount>/certs) with unexpected subject names or SANs (HashiCorp Advisory).

HashiCorp has released patches addressing this vulnerability. Users should upgrade to Vault Community Edition 2.1.2 or Vault Enterprise 2.1.2, 1.21.12, 1.20.17, or 1.19.23. As interim mitigations, administrators should review and strengthen PKI role policies to enforce stricter identity validation requirements for ACME certificate issuance, and consider restricting ACME server access to trusted clients only (e.g., via network controls or Vault policies). Upgrading to a patched version is the recommended long-term solution (HashiCorp Advisory, GitHub Advisory).

HashiCorp disclosed the vulnerability through their official security advisory forum (HCSEC-2026-40) on October 7, 2026, simultaneously releasing patched versions. No notable independent researcher commentary or significant social media discussion has been observed beyond standard vulnerability aggregator coverage.