CVE-2026-5052 Overview
CVE-2026-5052 is a Server-Side Request Forgery (SSRF) vulnerability in HashiCorp Vault's PKI secrets engine. The Automated Certificate Management Environment (ACME) validation logic did not reject local network targets when issuing http-01 and tls-alpn-01 challenges. An attacker who controls DNS resolution for a target domain can coerce Vault into sending validation requests to internal hosts. This may lead to information disclosure about internal network resources. The flaw is tracked under CWE-918 and affects both Vault Community Edition and Vault Enterprise.
Critical Impact
Unauthenticated network-based SSRF allowing attackers to probe internal services reachable from the Vault server through attacker-controlled DNS during ACME challenge validation.
Affected Products
- HashiCorp Vault Community Edition prior to 2.0.0
- HashiCorp Vault Enterprise prior to 2.0.0, 1.21.5, 1.20.10, and 1.19.16
- Deployments using the Vault PKI secrets engine with ACME enabled
Discovery Timeline
- 2026-04-17 - CVE-2026-5052 published to NVD
- 2026-04-27 - Last updated in NVD database
Technical Details for CVE-2026-5052
Vulnerability Analysis
Vault's PKI engine implements an ACME server compatible with RFC 8555 to automate certificate issuance. During the http-01 and tls-alpn-01 challenge flow, Vault connects to the host named in the certificate order to verify control of the domain.
The validator did not filter destination addresses resolved from attacker-supplied DNS records. An attacker who controls authoritative DNS for a domain can return a private RFC 1918 address, a loopback address, or any other internal endpoint. Vault then issues the challenge HTTP or TLS request to that internal target.
The response and error behavior leak information about reachable services, open ports, and internal infrastructure. Because the request originates from the Vault server, it can reach hosts behind firewalls that would otherwise block external traffic.
Root Cause
The root cause is missing destination validation in the ACME challenge client. The PKI engine resolved the challenge hostname and connected without enforcing an allow list or blocking link-local, loopback, private, and metadata service ranges. This is a classic Server-Side Request Forgery weakness mapped to CWE-918.
Attack Vector
The attack requires network access to a Vault PKI ACME endpoint and control over DNS resolution for a chosen domain. The attacker submits an ACME order for a domain they own, then serves a DNS response pointing to an internal IP address. Vault performs the challenge fetch against that internal target. No authentication or user interaction is required, and the impact crosses a security boundary into the internal network.
No verified proof-of-concept code is publicly available. See the HashiCorp Security Advisory HCSEC-2026-06 for additional technical context.
Detection Methods for CVE-2026-5052
Indicators of Compromise
- Outbound HTTP requests from Vault to RFC 1918, loopback, or link-local addresses on ports 80 or 443 during ACME challenge validation.
- ACME order requests in Vault audit logs referencing domains that resolve to internal IP ranges.
- Connections from Vault to cloud metadata endpoints such as 169.254.169.254 originating from PKI engine activity.
Detection Strategies
- Review Vault audit logs for pki/acme/* paths and correlate order identifiers with subsequent egress connections from the Vault host.
- Inspect DNS query logs for ACME challenge hostnames resolving to non-public address space within seconds of an order being placed.
- Alert on Vault server outbound connections to internal subnets that fall outside expected operational traffic patterns.
Monitoring Recommendations
- Capture netflow or eBPF connection telemetry from Vault hosts and baseline expected ACME destinations.
- Enable Vault audit devices and forward logs to a centralized analytics platform for retention and correlation.
- Monitor PKI engine metrics for unusual spikes in http-01 or tls-alpn-01 challenge attempts from a single account or namespace.
How to Mitigate CVE-2026-5052
Immediate Actions Required
- Upgrade to Vault Community Edition 2.0.0 or Vault Enterprise 2.0.0, 1.21.5, 1.20.10, or 1.19.16.
- Audit PKI mounts to identify which ones have ACME enabled and which accounts can submit orders.
- Restrict outbound network egress from Vault servers to only the destinations required for legitimate ACME validation.
Patch Information
HashiCorp resolved CVE-2026-5052 in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16. The fix rejects local network targets during http-01 and tls-alpn-01 challenge validation. Apply the patched build matching your release train. Refer to the HashiCorp Security Advisory HCSEC-2026-06 for release notes and upgrade guidance.
Workarounds
- Disable ACME on PKI mounts where it is not required by tuning the PKI engine configuration to turn off ACME issuance.
- Place Vault behind an egress proxy that blocks connections to RFC 1918, loopback, link-local, and cloud metadata ranges.
- Limit which ACME accounts and roles can request certificates by enforcing policy on the pki/acme/* paths.
# Disable ACME on a PKI mount until patches are applied
vault write <pki-mount>/config/acme enabled=false
# Verify current ACME configuration
vault read <pki-mount>/config/acme
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
