CVE-2026-92735

MEDIUMCVSS 5.90% EPSS

HashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow an unauthenticated attacker with network access to a new, uninitialized node to cause that node to send credentials from its server environment to an attacker-controlled server. This vulnerability (CVE-2026-92735) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.

Published 2026-11-13 · last modified 2026-11-13

Full record at NVD ↗

Ncerio by BeyondNets · data from NVD, CISA KEV, EPSS.