---
id: CVE-2026-4525
aliases:
  - GHSA-72gw-fmmr-c4r4
  - BIT-vault-2026-4525
  - GO-2026-5199
title: >-
  HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header
  Sanitization
summary: >-
  HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header
  Sanitization
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: hashicorp
product: github.com/hashicorp/vault
ecosystem: go
affected:
  - 'github.com/hashicorp/vault >= 0.11.2, <= 1.21.4'
published: '2026-04-17'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:43.378842123Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-72gw-fmmr-c4r4'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-4525'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-4525'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2459107'
  - url: >-
      https://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344
  - url: 'https://github.com/advisories/GHSA-72gw-fmmr-c4r4'
  - url: 'https://github.com/hashicorp/vault'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4525.json
tags:
  - osv
  - go
epss: 0.00406
epssPercentile: 0.34615
ingestedAt: '2026-07-21T19:04:58.193Z'
---

## Overview

If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

## Affected packages

- `github.com/hashicorp/vault >= 0.11.2, <= 1.21.4`

## Remediation

Refer to the advisory for the patched release.