HashiCorp — Security Activity Report

Terraform, Vault, Consul, Nomad

Generated Sep 19, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗

CVE Disclosure Volume

Total all-time: 52 CVEs with HashiCorp advisories. Source: NVD CVE records joined with vendor advisory publish dates.

Severity Composition

↓ -1.2 pp

51.9% of HashiCorp's 52 CVEs are CRITICAL or HIGH severity. Industry median: 53.1%. Source: NVD CVSS v3.1.

CRITICAL 3 (5.8%)HIGH 24 (46.2%)MEDIUM 25 (48.1%)

CISA KEV Listings

↓ -0.8 pp

0 of 52 HashiCorp CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (0.0%). Industry median: 0.8%.

Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.

Vendor Patch Velocity

Insufficient data to publish a reliable patch-velocity metric for HashiCorp(sample size: 3, minimum required: 10).

Top Recurring Weakness Classes

Most-frequently mapped CWEs across HashiCorp's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.

CWE-770Allocation of Resources Without Limits or Throttling10 CVEs
CWE-59Improper Link Resolution Before File Access (Link Following)7 CVEs
CWE-22Path Traversal6 CVEs
CWE-863Incorrect Authorization5 CVEs
CWE-862Missing Authorization3 CVEs

Recent Security Advisories

Latest advisories published by HashiCorp, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.

HCSEC-2026-39
Sep 15, 2026
HCSEC-2026-39 - Go-getter vulnerable to a privilege escalation issue in its archive decompression handling
CVE-2026-88922 vendor source ↗
HCSEC-2026-38
Sep 10, 2026
HCSEC-2026-38 - Consul-template vulnerable to an information disclosure issue in error handling
CVE-2026-87993 vendor source ↗
HCSEC-2026-37
Sep 10, 2026
HCSEC-2026-37 - Consul vulnerable to an authorization bypass in the Connect service mesh
CVE-2026-88021 vendor source ↗
HCSEC-2026-36
Sep 10, 2026
HCSEC-2026-36 - Consul vulnerable to an authorization bypass in the catalog deregistration path
CVE-2026-87107 vendor source ↗
HCSEC-2026-35
Sep 10, 2026
HCSEC-2026-35 - Consul vulnerable to a denial of service in the native RPC listener
CVE-2026-87106 vendor source ↗
HCSEC-2026-34
Sep 10, 2026
HCSEC-2026-34 - Consul vulnerable to an authorization bypass in the catalog node-write path
CVE-2026-87090 vendor source ↗
HCSEC-2026-33
Sep 10, 2026
HCSEC-2026-33 - HashiCorp Linux Signing GPG Key Update (CA026560)
vendor source ↗
HCSEC-2026-32
Aug 24, 2026
HCSEC-2026-32 - Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths
CVE-2026-5006 vendor source ↗

Full advisory archive: /pulse/vendor-advisories →

Data sources & corrections

NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
Vendor security advisories (RHSA, USN, MSRC, GHSA, etc.) — published_at timestamps
MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings

Snapshot generated Sep 19, 2026. Industry medians refresh every 6 hours; raw vendor counts are queried live on each request.

Spot a factual error in this report?

Email [email protected] with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.