HCSEC-2026-57 - Vault audit device prefix vulnerable to log injection

Bulletin ID: HCSEC-2026-57 Affected Products / Versions: Vault and Vault Enterprise up to 2.2.1; fixed in Vault 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25. Publication Date: November 12, 2026 Summary Vault’s audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading audit records. This vulnerability (CVE-2026-93333) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25. Background Vault audit devices record requests and responses for operational and security review, and support an optional prefix that is prepended to each audit log entry. Because audit logs are relied upon as a trusted record of activity, Vault provides the allow_audit_log_prefixing server configuration parameter, which is disabled by default and is intended to prevent audit devices from using prefixes unless an administrator explicitly allows it. Details Vault did not reject control characters or line separator characters in an audit log prefix. Because the prefix is written ahead of every audit entry, a crafted prefix could cause log consumers to interpret a single audit entry as multiple records, potentially allowing fabricated entries to appear alongside legitimate ones. In addition, the allow_audit_log_prefixing parameter was only enforced for file audit devices, so socket and syslog audit devices could be configured with a prefix even when the parameter was disabled. This issue requires an authenticated operator with privileges to enable audit devices. File audit devices are only affected when allow_audit_log_prefixing is enabled. Remediation Customers should evaluate the risk associated with this issue and consider upgrading to Vault Community Edition 2.2.2 or Vault Enterprise 2.2.2, 1.21.14, or 1.19.25. After upgradin…