hashicorp has 32 CVEs on record between 2021 and 2026. Disclosure cadence is accelerating: 6 in the last 90 days against 4 in the 90 before. The busiest recent month was September 2026 with 6. The median CVSS is 7.3 (high). None have a confirmed exploitation report. Most affected products: github.com/hashicorp/vault (15), github.com/hashicorp/consul (8), Consul (4).
CVEs per month
Last 12 months, by publish date
1025/101125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/09
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.3
- Publish → KEV
- —
- Last 90 days
- 6 prev 4
Products
- github.com/hashicorp/vault 15
- github.com/hashicorp/consul 8
- Consul 4
- Shared library 1
- Tooling 1
- github.com/hashicorp/boundary 1
32
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-87090High· 8.3Consul vulnerable to an authorization bypass in the catalog node-write path46CVE-2026-87993High· 7.7The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task event…42CVE-2023-5077High· 7.6Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability42CVE-2021-32574High· 7.5Hashicorp Consul Missing SSL Certificate Validation42CVE-2020-7219High· 7.5Denial of Service (DoS) in HashiCorp Consul42
hashicorp vulnerabilities
CVEs affecting hashicorp, newest first. Open any entry for full detail, references, and exploit status.
32 CVEsRSS
CVE-2021-32574High· 7.5Hashicorp Consul Missing SSL Certificate Validation
Hashicorp Consul Missing SSL Certificate Validation
▾ Twilighthashicorp · github.com/hashicorp/consulEPSS 1.5%via OSV
CVE-2020-7219High· 7.5Denial of Service (DoS) in HashiCorp Consul
Denial of Service (DoS) in HashiCorp Consul
▾ Twilighthashicorp · github.com/hashicorp/consulEPSS 2.0%via OSV