CVE-2026-4525

CVE-2026-4525 is a vulnerability in HashiCorp Vault that occurs when an auth mount is configured to forward the "Authorization" header for authentication purposes. Under these conditions, Vault inadvertently exposes its authentication tokens to backend auth plugins, creating a credential disclosure risk. The vulnerability affects Vault versions prior to 2.0.0, 1.21.5, 1.20.10, and 1.19.16. The vulnerability carries a HIGH severity rating with a CVSS score of 7.5, requiring low privileges and moderate attack complexity to exploit. The attack vector is network-based, and successful exploitation could result in confidentiality, integrity, and availability impacts. This suggests an attacker with valid Vault credentials could potentially leverage exposed tokens to gain unauthorized access or escalate privileges. There is no evidence of active exploitation at this time, as the vulnerability does not appear on CISA's Known Exploited Vulnerabilities list. The EPSS score of 0.00017 indicates minimal probability of exploitation in the wild. The FAUCET risk score of 38.0 suggests moderate concern from a risk management perspective, though immediate threat is low given no public exploit availability or documented active exploitation campaigns.