CVE-2026-7776: Boundary Worker TLS DoS Vulnerability

CVE-2026-7776 Overview

CVE-2026-7776 is a denial-of-service vulnerability affecting HashiCorp Boundary Community Edition and Boundary Enterprise workers. The flaw exists in the node enrollment Transport Layer Security (TLS) handshake process. An attacker with network access to the worker authentication listener can open a connection and delay or withhold the client certificate during the handshake. This blocks worker connection handling and prevents legitimate worker connections from being accepted or routed. HashiCorp tracks this issue in advisory HCSEC-2026-11 and resolved it in Boundary 0.21.3, 0.20.3, and 0.19.5. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling).

Critical Impact

Unauthenticated network attackers can disrupt Boundary worker availability and break session routing for downstream targets by stalling enrollment TLS handshakes.

Affected Products

• HashiCorp Boundary Community Edition versions prior to 0.21.3, 0.20.3, and 0.19.5
• HashiCorp Boundary Enterprise versions prior to 0.21.3, 0.20.3, and 0.19.5
• Boundary worker components exposing the node authentication listener

Discovery Timeline

• 2026-05-04 - CVE-2026-7776 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7776

Vulnerability Analysis

Boundary uses a node enrollment process where workers authenticate to controllers and other workers using mutual TLS (mTLS). During this exchange, the worker authentication listener accepts inbound TCP connections and initiates a TLS handshake that requires a client certificate. The vulnerable implementation does not enforce sufficient time or concurrency limits while waiting for the client certificate message.

An attacker who can reach the worker authentication listener can establish a TCP connection, begin a TLS handshake, then withhold or delay the client certificate. The worker's connection handling logic blocks while waiting for handshake completion. Repeated connections from a single source are sufficient to exhaust the resources used to process new enrollment requests.

The outcome is a denial of service against the worker. Legitimate workers and controller components cannot complete enrollment, and session routing through the affected worker degrades or fails. Confidentiality and integrity are not impacted, but availability is fully compromised.

Root Cause

The root cause is an absence of resource throttling on the worker authentication listener, consistent with CWE-770. The TLS handshake path lacks adequate handshake timeouts and per-source concurrency caps. Slow or partial handshakes hold worker resources indefinitely, blocking the connection pipeline.

Attack Vector

Exploitation requires only network reachability to the Boundary worker authentication listener. No credentials, no user interaction, and no valid certificate are required. The attacker initiates a TLS handshake and stalls before sending the client certificate message. Concurrent stalled handshakes from one or more sources monopolize the listener until the worker stops accepting new connections.

The vulnerability mechanism is described in the HashiCorp Security Advisory HCSEC-2026-11. No public proof-of-concept exploit is available at the time of publication.

Detection Methods for CVE-2026-7776

Indicators of Compromise

• Sustained TCP connections to the Boundary worker authentication listener that initiate a TLS ClientHello but never deliver a client certificate.
• Spikes in half-open or stalled TLS sessions on the worker port, accompanied by handshake timeout log entries.
• Sudden drops in successful worker enrollment events or session routing failures reported by Boundary controllers.

Detection Strategies

• Inspect Boundary worker logs for repeated TLS handshake timeout or tls: client did not provide a certificate style errors originating from the same source addresses.
• Correlate netflow or firewall telemetry against the worker authentication port to identify long-lived connections with minimal payload bytes after the initial handshake start.
• Baseline the normal rate of worker enrollments and alert on deviations that coincide with elevated handshake error counts.

Monitoring Recommendations

• Forward Boundary worker and controller logs to a centralized log platform and build alerts on handshake failure spikes.
• Track TCP connection duration distributions on the worker authentication listener and flag outliers.
• Monitor Boundary session establishment success rates and worker availability as service-level indicators.

How to Mitigate CVE-2026-7776

Immediate Actions Required

• Upgrade Boundary workers to version 0.21.3, 0.20.3, or 0.19.5 depending on your release line.
• Restrict network reachability of the worker authentication listener to known controller and worker IP ranges using firewall or security group rules.
• Audit current worker logs for evidence of stalled TLS handshakes prior to patching.

Patch Information

HashiCorp released fixed builds for both Community Edition and Enterprise. Upgrade to Boundary 0.21.3, 0.20.3, or 0.19.5 as published in the HashiCorp Security Advisory HCSEC-2026-11. The fix introduces stricter handshake handling on the worker authentication listener to prevent indefinite blocking by stalled clients.

Workarounds

• Place the Boundary worker authentication listener behind network access controls that allow only trusted controller and worker addresses.
• Apply rate limiting at upstream load balancers or firewalls to cap concurrent connections from any single source to the worker port.
• Increase monitoring sensitivity for worker availability and prepare automated worker restart procedures until patching completes.

# Example: restrict worker authentication listener to trusted CIDRs using iptables
iptables -A INPUT -p tcp --dport 9202 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9202 -j DROP

# Verify the installed Boundary version after upgrade
boundary version