---
id: CVE-2026-5807
aliases:
  - GHSA-88v5-9hxc-f85r
  - BIT-vault-2026-5807
  - GO-2026-5247
title: >-
  HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token
  Generation/Rekey Operations
summary: >-
  HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token
  Generation/Rekey Operations
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: hashicorp
product: github.com/hashicorp/vault
ecosystem: go
affected:
  - github.com/hashicorp/vault <= 1.21.4
published: '2026-04-17'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:43.840008232Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-88v5-9hxc-f85r'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-5807'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-5807'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2459109'
  - url: >-
      https://discuss.hashicorp.com/t/hcsec-2026-08-vault-vulnerable-to-denial-of-service-via-unauthenticated-root-token-generation-rekey-operations/77345
  - url: 'https://github.com/advisories/GHSA-88v5-9hxc-f85r'
  - url: 'https://github.com/hashicorp/vault'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5807.json
tags:
  - osv
  - go
epss: 0.00718
epssPercentile: 0.52419
ingestedAt: '2026-07-21T19:04:58.487Z'
---

## Overview

Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate operators from completing these workflows. This vulnerability, CVE-2026-5807, is fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0.

## Affected packages

- `github.com/hashicorp/vault <= 1.21.4`

## Remediation

Refer to the advisory for the patched release.