CVE-2026-5051 Overview
CVE-2026-5051 affects HashiCorp Vault and Vault Enterprise prior to version 2.0.1. The audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used. An authenticated operator with high privileges could bypass the plugin directory guard through this legacy path option, undermining a security boundary intended to constrain audit device file locations.
HashiCorp addressed the issue in Vault 2.0.1, 1.21.6, 1.20.11, and 1.19.17. The flaw is categorized as a path traversal weakness [CWE-22].
Critical Impact
Authenticated high-privilege users can bypass plugin directory restrictions when configuring audit devices, potentially exposing sensitive audit data outside the sanctioned plugin directory.
Affected Products
- HashiCorp Vault prior to 2.0.1, 1.21.6, 1.20.11, and 1.19.17
- HashiCorp Vault Enterprise prior to 2.0.1, 1.21.6, 1.20.11, and 1.19.17
- Deployments using the legacy file audit path option
Discovery Timeline
- 2026-07-01 - CVE-2026-5051 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-5051
Vulnerability Analysis
HashiCorp Vault supports audit devices that write operational logs to configured destinations. The file audit device is expected to honor plugin directory protections, which restrict where audit output can be placed on the underlying host. Vault enforces these protections to prevent audit device configuration from being abused to read or write arbitrary filesystem locations.
The validation logic in versions prior to the fix did not consistently apply this guard when operators enabled audit devices using the legacy path option. As a result, the plugin directory restriction could be circumvented depending on how the audit device was configured. The issue maps to [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.
Root Cause
The root cause is inconsistent enforcement of the plugin directory boundary in the audit device configuration code path. Newer configuration options applied the directory guard, but the legacy file audit path option skipped the check. This inconsistency created a bypass primitive exploitable only by users already possessing privileges to manage audit devices.
Attack Vector
Exploitation requires network access to the Vault API and elevated privileges sufficient to configure audit devices. An authorized administrator or a compromised high-privilege token could enable an audit device with the legacy path option pointed at a location outside the plugin directory. Successful exploitation results in confidentiality impact on the host filesystem context surrounding Vault, though integrity and availability of Vault itself are not directly affected.
No code example is available from the vendor advisory. See the HashiCorp Security Advisory HCSEC-2026-16 for details.
Detection Methods for CVE-2026-5051
Indicators of Compromise
- Audit device enable events (sys/audit) referencing file paths outside the configured plugin directory.
- Use of the legacy file audit path option in Vault configuration or API requests.
- Vault operator tokens creating or modifying audit devices from unexpected client IPs or service accounts.
Detection Strategies
- Review Vault operational logs for POST requests to sys/audit/* endpoints and correlate the specified path against the sanctioned plugin directory.
- Alert when audit device configuration payloads include legacy path options rather than the current plugin-based configuration.
- Baseline the set of authorized administrators permitted to manage audit devices and flag deviations.
Monitoring Recommendations
- Forward Vault audit and operational logs to a centralized log platform with alerting on sys/audit mutations.
- Monitor filesystem writes by the Vault process to paths outside the plugin and expected audit directories.
- Track Vault version inventory to identify hosts still running affected releases.
How to Mitigate CVE-2026-5051
Immediate Actions Required
- Upgrade Vault and Vault Enterprise to 2.0.1, 1.21.6, 1.20.11, or 1.19.17 as appropriate for your release train.
- Audit existing audit device configurations and remove any using the legacy file path option pointing outside the plugin directory.
- Rotate high-privilege Vault tokens and root tokens if unauthorized audit device changes are suspected.
Patch Information
HashiCorp fixed CVE-2026-5051 in Vault and Vault Enterprise versions 2.0.1, 1.21.6, 1.20.11, and 1.19.17. Refer to the HashiCorp Security Advisory HCSEC-2026-16 for the official remediation guidance and release notes.
Workarounds
- Restrict audit device management capabilities to a minimal set of trusted operators via Vault policies.
- Avoid the legacy file audit path option and use the current plugin-based audit device configuration.
- Enforce filesystem-level access controls so the Vault process cannot write outside expected audit and plugin directories.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
