---
id: CVE-2026-5052
aliases:
  - GHSA-8r5m-3f66-qpr3
  - BIT-vault-2026-5052
  - GO-2026-5262
title: >-
  HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation
  via Attacker-Controlled DNS
summary: >-
  HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation
  via Attacker-Controlled DNS
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
vendor: hashicorp
product: github.com/hashicorp/vault
ecosystem: go
affected:
  - 'github.com/hashicorp/vault >= 1.14.0, <= 1.21.4'
published: '2026-04-17'
updated: '2026-07-21'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-8r5m-3f66-qpr3'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-5052'
  - url: >-
      https://discuss.hashicorp.com/t/hcsec-2026-06-vault-vulnerable-to-server-side-request-forgery-in-acme-challenge-validation-via-attacker-controlled-dns/77343
  - url: 'https://github.com/advisories/GHSA-8r5m-3f66-qpr3'
  - url: 'https://github.com/hashicorp/vault'
tags:
  - osv
  - go
epss: 0.00345
epssPercentile: 0.28169
ingestedAt: '2026-07-21T19:04:58.559Z'
---

## Overview

Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

## Affected packages

- `github.com/hashicorp/vault >= 1.14.0, <= 1.21.4`

## Remediation

Refer to the advisory for the patched release.