Server-Side Request Forgery Vulnerability in HashiCorp Boundary Product
CVE-2026-13303

8.7HIGH

Key Information:

Vendor

Hashicorp
Status
Boundary
Boundary Enterprise
Vendor
CVE Published:
29 October 2026

What is CVE-2026-13303?

HashiCorp Boundary, including Boundary Enterprise, is susceptible to a server-side request forgery (SSRF) vulnerability pertaining to its Vault credential store integration. This allows an authenticated user, possessing appropriate permissions to manage credential stores and libraries within a project, to manipulate the Boundary controller into issuing outbound requests to a network destination specified by the user. Such a security flaw can potentially expose sensitive endpoints, accessible solely from the controller's host, including critical services like cloud instance metadata. The issue has been rectified in Boundary Enterprise versions 1.0.2 and 0.21.6.

Affected Version(s)

Boundary 64 bit 0.21.3

Boundary Enterprise 64 bit 0.21.3 < 1.0.2

References

https://discuss.hashicorp.com/t/hcsec-2026-54-boundary-vu...

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was reported to HashiCorp by Owais Lone.
.