HashiCorp Nomad symlink escape and Boundary SSRF disclosed
Nomad dispatch writes can leave the allocation directory via symlinks, and Boundary has SSRF in its Vault credential store.
64
Vendor
HashiCorp
- Mentions · 7d4
- Mentions · 30d15
- All mentions26
- First seenSep 11, 2026
- Last mentioned2d ago
Timeline
26 articles · newest firstHashiCorp patches Consul-k8s cross-namespace ACL bypass (CVE-2026-110720)
Versions 0.42.0 through 2.0.4 are affected only with system ACL management on; fixes are 1.8.18 and 2.1.0.
58
consul-k8s ACL flaw can grant elevated Consul privileges (CVE-2026-110720)
An attacker must already create a ServiceAccount in another namespace and reach the Consul API; active exploitation is not confirmed.
64
HashiCorp Consul auth bypass in service mesh leaf certificate API
Canada’s Cyber Centre urges admins to apply HashiCorp updates for Consul and Consul Enterprise as they become available.
52
Buyer’s guide compares 12 encryption and key-management products
The comparison covers cloud KMS, enterprise custody, secrets engines, and HSMs, with post-quantum readiness as a selection criterion.
16
Top 10 Best Encryption & Key Management Solutions in 2026 [Ranked & Scored]
Thales, AWS KMS, and Fortanix top a 2026 ranking of encryption key-management platforms.
18
11 Best Infrastructure as Code (IaC) Security Tools Compared (2026): Features & Pricing
A 2026 buyer's comparison ranks 11 IaC security scanners, platforms, and Terraform governance tools.
22
HashiCorp archives the Boundary open source repo
HashiCorp archived the open-source Boundary privileged-access repository, ending public development.
38
Hackers Abuse Trusted Terraform Workflows to Infect Developer Systems With Cross-Platform Malware
A trojanized Terraform AWS provider installs FLATROOF and ROOFDECK malware on developer macOS, Linux, and Windows systems.
76
Suspected TraderTraitor Hackers Trojanize Terraform Provider to Deploy Cross-Platform Malware
Suspected North Korean hackers trojanized a Terraform provider to install FLATROOF and ROOFDECK on developer machines.
76
Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware
Suspected TraderTraitor operators trojanized a Terraform provider to deliver the cross-platform FLATROOF backdoor.
72
HashiCorp security advisory (AV26-1019)
Canada’s Cyber Centre warns older HashiCorp Vault builds allow code execution via Raft snapshot plugin entries.
58
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm
Compromised tensorlake npm 0.5.144 delivered the Shai-Hulud worm to steal secrets and spread to other packages.
73
12 Best Secrets Management Tools Compared (2026): Features & Pricing
A 2026 roundup compares 12 secrets-management tools, ranking HashiCorp Vault, cloud vaults, Akeyless, and ephemeral-access brokers.
22
Top 10 Best Machine Identity Management Solutions in 2026 [Ranked & Scored]
A 2026 buyer ranking of machine-identity tools highlights Venafi, Keyfactor, and DigiCert amid shorter TLS lifetimes.
16
12 Best Cloud Encryption Solutions Compared (2026): Features & Pricing
A 2026 buyer's guide compares 12 cloud encryption platforms and favors native cloud KMS.
20
CVE-2026-97636: Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key
Apache Airflow HashiCorp provider flaw lets a team-scoped DAG author read another team's Vault secret.
48
Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry
DPRK-linked actors planted Go malware in HashiCorp Terraform providers and Go modules.
74
Top 10 Best Secrets Management Tools in 2026 [Ranked & Scored]
A 2026 industry report ranked HashiCorp Vault as the top secrets management tool, emphasizing dynamic credentials and cloud-native integrations.
30
North Korean TraderTraitor Hackers Use Fake Terraform Job Tests to Deploy macOS Backdoors
North Korean TraderTraitor used fake Terraform job tests to plant macOS backdoors and reach cloud accounts.
78
Hackers Weaponize Terraform Lock Files to Infect DevOps Engineers With macOS Backdoors
North Korea-linked TraderTraitor uses weaponized Terraform lock files in fake job-interview GitHub repos to deploy FLATROOF and ROOFDECK macOS backdoors on DevOps engineers.
80
Top 10 Best Privileged Access Management (PAM) Solutions in 2026
Cyber Security News ranks the top 10 privileged access management solutions of 2026, led by CyberArk, BeyondTrust, and Delinea.
15
Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors
Jade Sleet breached an Indian IT provider with macOS backdoors FLATROOF and ROOFDECK.
76
Top 10 Best Cloud Encryption Solutions in 2026
A 2026 buyer's guide reviews ten cloud encryption and key management platforms, spanning hyperscaler-native KMS and dedicated multicloud sovereignty solutions.
12
CISA and NIST Issue Guidance to Protect Cloud Identity Tokens
CISA and NIST published Interagency Report 8587 with voluntary guidance to harden cloud identity tokens against theft, forgery, and lateral movement.
52
HashiCorp security advisory (AV26-910)
Canada's Cyber Centre warns HashiCorp Consul and consul-template have authorization bypass and information disclosure flaws, urging users to apply available updates.
25
Related CVEs
by mentions- Cross-namespace ACL bypass in Consul-k8s 0.42.0+
- Apache Airflow HashiCorp provider
Appears with
- HashiCorp Vaultproduct · 10
- Microsoftvendor · 9
- Terraformproduct · 7
- TraderTraitorthreat actor · 6
- FLATROOFmalware · 6
- ROOFDECKmalware · 6
- Azure Key Vaultproduct · 6
- Jade Sleetthreat actor · 5
- Amazon Web Servicesvendor · 5
- Googlevendor · 5
- AWS KMSproduct · 4
- Thalesvendor · 4
- Canadian Centre for Cyber Securityorganization · 4
- CipherTrustproduct · 4
- IBMvendor · 4
- Entrustvendor · 4
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.