High
Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header
Type: advisorySources: OSV
If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-4525
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 17:21 UTC · Revision 1
Source evidence
Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header
core-osv · Original sourcePublished 17 Apr 2026, 03:00 UTC
If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
osv:CVE-2026-4525
Complete source record
{
"id": "24e46fba15c944ad8674dc0e57850d76e5c2f7aac1240fac1436073a10534788",
"url": "https://osv.dev/vulnerability/CVE-2026-4525",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header",
"summary": "If a Vault auth mount is configured to pass through the \"Authorization\" header, and the \"Authorization\" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.",
"evidence": "osv:CVE-2026-4525",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-4525",
"aliases": [
"BIT-vault-2026-4525",
"CVE-2026-4525",
"GHSA-72gw-fmmr-c4r4",
"GO-2026-5199"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/hashicorp/vault",
"type": "GIT",
"events": [
{
"introduced": "2b1a4304374712953ff606c6a925bbe90a4e85dd"
},
{
"fixed": "cf1ce4df8af6e323558bd5f8c37e771388cbc951"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0.11.2"
},
{
"fixed": "2.0.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"cpe": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "0.11.2"
},
{
"fixed": "2.0.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v2.0.0-rc1",
"sdk/v0.19.0",
"api/v1.21.0",
"sdk/v0.14.1",
"sdk/v0.18.0",
"api/auth/userpass/v0.10.0",
"api/auth/ldap/v0.10.0",
"api/auth/kubernetes/v0.10.0",
"api/auth/gcp/v0.10.0",
"api/auth/azure/v0.9.0",
"api/auth/aws/v0.10.0",
"api/auth/approle/v0.10.0",
"api/v1.20.0",
"sdk/v0.17.0",
"sdk/v0.16.0",
"sdk/v0.15.0",
"api/auth/userpass/v0.9.0",
"api/auth/ldap/v0.9.0",
"api/auth/kubernetes/v0.9.0",
"api/auth/gcp/v0.9.0",
"api/auth/azure/v0.8.0",
"api/auth/aws/v0.9.0",
"api/auth/approle/v0.9.0",
"api/v1.16.0",
"sdk/v0.14.0",
"api/auth/userpass/v0.8.0",
"api/auth/ldap/v0.8.0",
"api/auth/kubernetes/v0.8.0",
"api/auth/gcp/v0.8.0",
"api/auth/azure/v0.7.0",
"api/auth/aws/v0.8.0",
"api/auth/approle/v0.8.0",
"api/v1.15.0",
"sdk/v0.13.0",
"api/auth/userpass/v0.7.0",
"api/auth/ldap/v0.7.0",
"api/auth/kubernetes/v0.7.0",
"api/auth/gcp/v0.7.0",
"api/auth/azure/v0.6.0",
"api/auth/aws/v0.7.0",
"api/auth/approle/v0.7.0",
"api/v1.14.0",
"api/v1.13.0",
"sdk/v0.12.0",
"api/v1.12.2",
"sdk/v0.11.1",
"api/v1.12.1",
"api/auth/userpass/v0.6.0",
"api/auth/ldap/v0.6.0",
"api/auth/kubernetes/v0.6.0",
"api/auth/gcp/v0.6.0",
"api/auth/aws/v0.6.0",
"api/auth/approle/v0.6.0",
"sdk/v0.11.0",
"api/v1.12.0",
"api/v1.11.0",
"sdk/v0.10.1",
"api/auth/userpass/v0.5.0",
"api/auth/ldap/v0.5.0",
"api/auth/kubernetes/v0.5.0",
"api/auth/gcp/v0.5.0",
"api/auth/azure/v0.5.0",
"api/auth/aws/v0.5.0",
"api/auth/approle/v0.5.0",
"sdk/v0.10.0",
"api/v1.10.0",
"sdk/v0.9.2",
"api/auth/userpass/v0.4.1",
"api/auth/ldap/v0.4.1",
"api/auth/kubernetes/v0.4.1",
"api/auth/gcp/v0.4.1",
"api/auth/azure/v0.4.1",
"api/auth/aws/v0.4.1",
"api/auth/approle/v0.4.1",
"sdk/v0.9.1",
"api/v1.9.2",
"api/v1.9.1",
"sdk/v0.9.0",
"api/auth/userpass/v0.4.0",
"api/auth/ldap/v0.4.0",
"api/auth/kubernetes/v0.4.0",
"api/auth/gcp/v0.4.0",
"api/auth/azure/v0.4.0",
"api/auth/aws/v0.4.0",
"api/auth/approle/v0.4.0",
"sdk/v0.8.0",
"api/v1.9.0",
"api/v1.8.3",
"sdk/v0.7.0",
"sdk/v0.6.2",
"sdk/v0.6.1",
"api/v1.8.2",
"api/v1.8.1",
"api/auth/userpass/v0.3.0",
"api/auth/ldap/v0.3.0",
"api/auth/kubernetes/v0.3.0",
"api/auth/gcp/v0.3.0",
"api/auth/azure/v0.3.0",
"api/auth/aws/v0.3.0",
"api/auth/approle/v0.3.0",
"api/v1.8.0",
"sdk/v0.6.0",
"api/auth/userpass/v0.2.0",
"api/auth/ldap/v0.2.0",
"api/auth/kubernetes/v0.2.0",
"api/auth/gcp/v0.2.0",
"api/auth/azure/v0.2.0",
"api/auth/aws/v0.2.0",
"api/auth/approle/v0.2.0",
"sdk/v0.5.3",
"api/v1.7.2",
"sdk/v0.5.1",
"api/v1.7.1",
"api/v1.7.0",
"api/v1.6.0",
"sdk/v0.5.0",
"api/v1.5.0",
"sdk/v0.4.1",
"last-go-modable",
"api/auth/ldap/v0.1.0",
"api/v1.3.1",
"api/auth/approle/v0.1.1",
"main-creation",
"api/auth/gcp/v0.1.0",
"api/auth/azure/v0.1.0",
"api/auth/userpass/v0.1.0",
"api/auth/kubernetes/v0.1.0",
"api/auth/aws/v0.1.0",
"api/auth/approle/v0.1.0",
"sdk/v0.3.0",
"api/v1.2.0",
"api/v1.1.1",
"sdk/v0.2.1",
"v1.2.0",
"v1.2.0-rc1",
"api/v1.0.4",
"sdk/v0.1.13",
"api/v1.0.3",
"sdk/v0.1.12",
"v1.2.0-beta2",
"v1.2.0-beta1",
"sdk/v0.1.11",
"sdk/v0.1.10",
"api/v1.0.2",
"v1.1.1",
"sdk/v0.1.9",
"api/v1.0.1",
"sdk/v0.1.8",
"v1.1.0",
"v1.1.0-beta2",
"v1.1.0-beta1",
"v1.0.3",
"v1.0.2",
"v1.0.1",
"v1.0.0",
"v1.0.0-rc1",
"v1.0.0-beta2",
"v1.0.0-beta1",
"v0.11.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4525.json"
}
}
],
"modified": "2026-10-28T02:30:44.598979324Z",
"provider": "osv",
"references": [
"https://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344",
"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4525.json",
"https://access.redhat.com/security/cve/CVE-2026-4525",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4525.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-4525",
"https://bugzilla.redhat.com/show_bug.cgi?id=2459107",
"https://github.com/hashicorp/vault"
],
"provider_metadata": {
"cwe_ids": [
"CWE-201"
],
"cna_assigner": "HashiCorp",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "0.11.2"
},
{
"fixed": "1.19.16"
}
],
"source": "AFFECTED_FIELD",
"strategy": "ChangesAt"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4525.json"
}
},
"related_cves": [
{
"value": "CVE-2026-4525",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 512527,
"published_at": "2026-04-17T03:00:47.561+00:00"
}