CVE-2026-5807: HashiCorp Vault DoS Vulnerability

CVE-2026-5807 Overview

HashiCorp Vault is vulnerable to a denial-of-service (DoS) condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations. By continuously occupying the single in-progress operation slot, attackers can prevent legitimate operators from completing critical security workflows such as root token generation and rekeying procedures.

Critical Impact

This vulnerability allows unauthenticated remote attackers to disrupt essential Vault administrative operations, potentially preventing emergency security procedures and leaving organizations unable to perform critical key management tasks.

Affected Products

• HashiCorp Vault Community Edition (versions prior to 2.0.0)
• HashiCorp Vault Enterprise (versions prior to 2.0.0)

Discovery Timeline

• 2026-04-17 - CVE CVE-2026-5807 published to NVD
• 2026-04-17 - Last updated in NVD database

Technical Details for CVE-2026-5807

Vulnerability Analysis

This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The core issue stems from Vault's handling of root token generation and rekey operations, which are designed to allow only a single operation to be in progress at any given time. This design decision, while logical for maintaining operational integrity, creates a race condition opportunity when combined with the lack of authentication requirements for initiating or canceling these operations.

An unauthenticated attacker can exploit this single-slot limitation by continuously cycling through initiation and cancellation requests. Since no authentication is required to interact with these endpoints, the attacker can effectively monopolize the operation slot indefinitely, preventing any legitimate administrator from gaining access to perform these critical security functions.

The impact is particularly severe in scenarios where emergency root token generation is required—such as recovering from lost credentials or performing urgent security rotations—as the attacker can maintain persistent denial of these capabilities.

Root Cause

The vulnerability originates from insufficient access controls on the root token generation and rekey operation endpoints. Vault implements a single operation slot for these sensitive procedures but fails to enforce authentication before allowing interactions with this shared resource. This design flaw allows unauthenticated network actors to monopolize the resource through rapid initiate/cancel cycles.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker with network access to the Vault API can exploit this vulnerability by sending repeated HTTP requests to initiate and immediately cancel root token generation or rekey operations. The attack maintains low complexity since it only requires basic HTTP request capabilities and knowledge of the vulnerable API endpoints.

The attacker establishes a persistent loop that occupies the single operation slot, effectively implementing a resource exhaustion attack against Vault's administrative functionality. Since only one root token generation or rekey operation can be in progress at any time, legitimate operators are locked out until the attacker ceases their activity.

Detection Methods for CVE-2026-5807

Indicators of Compromise

• Unusually high frequency of root token generation initiation requests from external or unauthorized IP addresses
• Repeated cancellation requests for root token generation or rekey operations in rapid succession
• Failed attempts by legitimate administrators to initiate root token generation or rekey workflows
• Audit log entries showing alternating initiate/cancel patterns from the same source

Detection Strategies

• Monitor Vault audit logs for anomalous patterns in root token generation and rekey operation requests
• Implement rate limiting alerts on the /sys/generate-root/ and /sys/rekey/ API endpoints
• Configure SIEM rules to detect high-frequency request patterns targeting administrative endpoints
• Deploy network-level monitoring to identify sustained connections attempting denial-of-service patterns

Monitoring Recommendations

• Enable comprehensive audit logging for all Vault administrative operations
• Set up alerting thresholds for failed administrative operation attempts
• Monitor for API requests to sensitive endpoints from unauthenticated sources
• Implement anomaly detection for unusual API call patterns against root token and rekey endpoints

How to Mitigate CVE-2026-5807

Immediate Actions Required

• Upgrade HashiCorp Vault Community Edition to version 2.0.0 or later
• Upgrade HashiCorp Vault Enterprise to version 2.0.0 or later
• Review network access controls to limit exposure of Vault API endpoints
• Implement network-level rate limiting on administrative API endpoints as an interim measure

Patch Information

HashiCorp has addressed this vulnerability in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0. Organizations should upgrade to these versions immediately. For detailed patch information and upgrade instructions, refer to the HashiCorp Security Advisory HCSEC-2026-08.

Workarounds

• Restrict network access to Vault administrative endpoints using firewall rules or network segmentation
• Implement a reverse proxy or API gateway with rate limiting capabilities in front of Vault
• Monitor and temporarily block IP addresses exhibiting suspicious request patterns
• Consider deploying Vault behind a VPN or private network to reduce attack surface exposure

# Example: Implement network-level access restrictions for Vault API
# Restrict access to administrative endpoints to trusted management networks only
iptables -A INPUT -p tcp --dport 8200 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8200 -j DROP