HashiCorp Nomad symlink escape and Boundary SSRF disclosed
Nomad dispatch writes can leave the allocation directory via symlinks, and Boundary has SSRF in its Vault credential store.
Stories per day · 30 days
2 RSS
Relatedauthorization-bypass3consul3kubernetes2acl1boundary1certificate1consul-k8s1nomad1privilege-escalation1service-mesh1ssrf1symlink1
9 stories, newest first · one card per story
Stories tagged #hashicorp
HashiCorp patches Consul-k8s cross-namespace ACL bypass (CVE-2026-110720)
Versions 0.42.0 through 2.0.4 are affected only with system ACL management on; fixes are 1.8.18 and 2.1.0.
consul-k8s ACL flaw can grant elevated Consul privileges (CVE-2026-110720)
An attacker must already create a ServiceAccount in another namespace and reach the Consul API; active exploitation is not confirmed.
HashiCorp Consul auth bypass in service mesh leaf certificate API
Canada’s Cyber Centre urges admins to apply HashiCorp updates for Consul and Consul Enterprise as they become available.
HashiCorp archives the Boundary open source repo
HashiCorp archived the open-source Boundary privileged-access repository, ending public development.
HashiCorp security advisory (AV26-1019)
Canada’s Cyber Centre warns older HashiCorp Vault builds allow code execution via Raft snapshot plugin entries.
CVE-2026-97636: Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key
Apache Airflow HashiCorp provider flaw lets a team-scoped DAG author read another team's Vault secret.
Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry
DPRK-linked actors planted Go malware in HashiCorp Terraform providers and Go modules.
HashiCorp security advisory (AV26-910)
Canada's Cyber Centre warns HashiCorp Consul and consul-template have authorization bypass and information disclosure flaws, urging users to apply available updates.