CVE-2026-5051: 
HashiCorp Vault vulnerability analysis and mitigation

CVE-2026-5051 is a path traversal vulnerability in HashiCorp Vault and Vault Enterprise where the audit device validation logic does not consistently apply plugin directory protections when the legacy file audit path option is used. It affects Vault versions from 1.20.1 up to (but not including) 2.0.1, and Vault Enterprise versions from 1.19.0 up to (but not including) 2.0.1. The vulnerability was disclosed on July 1, 2026, and carries a CVSS v3.1 base score of 4.4 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal) and CWE-807 (Reliance on Untrusted Inputs in a Security Decision). When the legacy file audit device path option is configured, Vault's validation logic fails to consistently enforce plugin directory boundary restrictions, allowing a path traversal condition to occur. Exploitation requires high privileges (administrative access) and high attack complexity over a network vector, meaning an attacker must already hold elevated Vault credentials and craft specific audit device configurations to trigger the bypass (GitHub Advisory, HashiCorp Advisory).

Successful exploitation allows a high-privileged administrator with network access to Vault to read sensitive audit data outside the intended plugin directory boundaries, resulting in a high confidentiality impact. There is no integrity or availability impact — the vulnerability is limited to unauthorized file/data disclosure. Because exploitation requires existing administrative privileges, the risk of lateral movement is limited, but exposure of audit logs could reveal sensitive operational data about Vault usage, secrets access patterns, and authentication events (GitHub Advisory, HashiCorp Advisory).

HashiCorp has released patched versions addressing this vulnerability: 2.0.1, 1.21.6, 1.20.11, and 1.19.17. Organizations should upgrade to one of these versions as the primary remediation. As a workaround, avoid using the legacy file audit path option in audit device configurations, and review existing audit device configurations to ensure plugin directory protections are properly enforced. Restricting administrative access to Vault to only authorized personnel reduces the attack surface given the high-privilege requirement (HashiCorp Advisory, GitHub Advisory).

The vulnerability was assigned by HashiCorp and disclosed via their official security advisory forum (HCSEC-2026-16). Red Hat tracked the issue via Bugzilla with a medium severity rating. No notable independent researcher commentary or significant social media discussion has been observed beyond standard CVE aggregator coverage (Red Hat Bugzilla, HashiCorp Advisory).