Log Injection Vulnerability in HashiCorp Vault Audit Logs
CVE-2026-93333

2.7LOW

Key Information:

Vendor

Hashicorp
Status
Vault
Vault Enterprise
Vendor
CVE Published:
12 November 2026

What is CVE-2026-93333?

A vulnerability in HashiCorp Vault's audit devices allows for log injection due to insufficient validation of configured audit log prefixes. This exposure enables a privileged operator to manipulate audit logs, resulting in potentially misleading or forged entries. Such manipulation can compromise the integrity of audit records, making it vital for users of Vault to upgrade to secured versions. The issue has been addressed in Vault Community Edition 2.2.2, Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.

Affected Version(s)

Vault 64 bit 0.7.0 < 2.2.2

Vault Enterprise 64 bit 0.7.0 < 2.2.2

References

https://discuss.hashicorp.com/t/hcsec-2026-57-vault-audit...

CVSS V3.1

Score:
2.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was reported to HashiCorp by Tal Vaknin, Independent Security Researcher.
.