HashiCorp security advisory (AV26-1019)
Canada’s Cyber Centre warns older HashiCorp Vault builds allow code execution via Raft snapshot plugin entries.
Stories per day · 30 days
2 RSS
3 stories, newest first · one card per story
Stories tagged #vault
API Secrets Should Never Become Tokens in the LLM's Vocabulary: A Threat Analysis of API Credential Handling in LLM Agent Systems and an Empirical Evaluation of a Vault-Mediated Execution Boundary
Researchers show LLM agents can expose API secrets and evaluate a vault that keeps credentials outside the model.
CVE-2026-97636: Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key
Apache Airflow HashiCorp provider flaw lets a team-scoped DAG author read another team's Vault secret.