Advisories · Technology
HashiCorp Tooling.
Every CVE that names HashiCorp Tooling among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.9 CriticalCritical · CVSS 9+
Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules
- HashiCorp Tooling
- Broken access control
- CVSS 7.7 High
Consul-template vulnerable to an information disclosure issue in error handling
- HashiCorp Tooling
- Information disclosure
- CVSS 9.6 CriticalCritical · CVSS 9+
Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath
- HashiCorp Tooling
- Information disclosure
- CVSS 10.0 CriticalCritical · CVSS 9+
consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
- HashiCorp Tooling
- CWE-488
- CVSS 8.6 High
consul-mcp-server vulnerable to server side request forgery leading to token exposure
- HashiCorp Tooling
- Server-side request forgery (SSRF)
- CVSS 10.0 CriticalCritical · CVSS 9+
terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
- HashiCorp Tooling
- CWE-488
- CVSS 8.9 High
terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user
- HashiCorp Tooling
- Authentication bypass
- CVSS 8.6 High
terraform-mcp-server vulnerable to server side request forgery leading to token exposure
- HashiCorp Tooling
- Server-side request forgery (SSRF)
- CVSS 4.7 Medium
Consul-template is vulnerable to path redirection in writeToFile through symlink attack
- HashiCorp Tooling
- Path traversal
- CVSS 4.7 Medium
Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack
- HashiCorp Tooling
- Path traversal