01 Record

CVE-2026-8715

Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath

CriticalPUBLISHEDCNA: HashiCorp

Base score9.6 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

02 Description

Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath

Published: 2026-08-13 20:27Z22 HR AGO
Last updated: 2026-08-14 12:38Z6 HR AGO
Reserved: 2026-05-15
Assigning CNA: HashiCorp
Record state: PUBLISHED
Severity: Critical (CVSS 9.6)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Weaknesses: CWE-552
SSVC decision: ExploitationnoneAutomatablenoTechnical Impacttotal
Data version: 5.2
Document digest: 7019954874cd38f392fbba3bf50d645b48d00c58d325cf42200e8cd244ada0de

VendorProductVersionsPlatforms

HashiCorpTooling1.3.0 to < 1.5.064 bit, 32 bit, x86, ARM, MacOS, Windows, Linux