CVE-2026-5052

OVERVIEW CVE-2026-5052 is a validation bypass vulnerability in HashiCorp Vault's PKI engine ACME implementation that fails to reject local network targets when processing http-01 and tls-alpn-01 challenges. This flaw affects Vault Community Edition prior to 2.0.0 and Vault Enterprise versions 1.19.x prior to 1.19.16, 1.20.x prior to 1.20.10, and 1.21.x prior to 1.21.5. The vulnerability allows attackers to direct validation requests to internal network resources, creating an information disclosure risk. SEVERITY The vulnerability carries a CVSS score of 5.3 (Medium) with a network-based attack vector requiring no authentication or user interaction, indicating accessible exploitation. The impact is limited to confidentiality breach with no effect on integrity or availability. The FAUCET Risk Score of 32.0/100 places this as a moderate-priority issue within the broader threat landscape. EXPLOITATION STATUS This vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and shows minimal community attention with an EPSS score of 0.000120000, well below the typical exploitation baseline. No active exploitation has been reported, and the low EPSS rating suggests limited real-world attack probability. Organizations should prioritize patching to prevent potential information disclosure but can plan remediation within standard maintenance windows.