// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Yesterday
-
HCSEC-2026-54 - Boundary vulnerable to server-side request forgery in Vault credential store
HashiCorp Boundary and Boundary Enterprise versions 0.21.3 up to 1.0.1 are vulnerable to server-side request forgery (HCSEC-2026-54), fixed in versions 1.0.2 and 0.21.6.
-
HCSEC-2026-53 - Nomad allocation data migration may allow host directory permission modification via symlink following
HashiCorp Nomad and Nomad Enterprise up to 2.0.7 are vulnerable to symlink following during allocation data migration, potentially allowing a malicious workload to modify host directory permissions.
-
HCSEC-2026-52 - Nomad dispatch payload writes can escape the allocation directory through symlinks
HashiCorp Nomad and Nomad Enterprise up to 2.0.7 are vulnerable to symlink following during dispatch payload writes, allowing a malicious workload to modify files outside its allocation directory.
-
HCSEC-2026-51 - Nomad vulnerable to cross-namespace information disclosure in multiple endpoints
HashiCorp Nomad and Nomad Enterprise up to 2.0.7 are vulnerable to cross-namespace information disclosure in read-only API endpoints, fixed in versions 2.1.0, 1.11.12, and 1.10.18.
# 26 Oct
-
HCSEC-2026-50 - Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules
Consul-k8s versions 0.42.0 up to 2.0.4 are vulnerable to CVE-2026-110720, a cross-namespace authorization bypass allowing elevated Consul privileges, fixed in 1.8.18 and 2.1.0.
-
HCSEC-2026-49 - Consul vulnerable to an authorization bypass in health check registration
HashiCorp Consul and Consul Enterprise versions 0.7.2 up to 2.0.4 are vulnerable to an authorization bypass allowing authenticated users to modify other services' health checks on the same node.
-
HCSEC-2026-48 - Consul vulnerable to a denial of service in HTTP APIs
HashiCorp Consul and Consul Enterprise up to 2.0.4 are vulnerable to CVE-2026-105626, a denial of service in the HTTP API allowing an unauthenticated attacker to exhaust memory.
-
HCSEC-2026-47 - Consul vulnerable to an authorization bypass in service mesh registration
HashiCorp Consul 2.0.4, 1.22.12, and Consul Enterprise 2.0.4, 1.21.18 are vulnerable to an authorization bypass allowing service write users to apply Envoy escape-hatch configuration.
-
HCSEC-2026-46 - Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API
HashiCorp Consul and Consul Enterprise versions 1.17.0 up to 2.0.4 have an authorization bypass in the agent's service mesh leaf certificate API allowing attackers to retrieve private keys.