HCSEC-2026-41 - Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots

{
  "id": "7e1f1b8f23ff962287c4809fc39a718882adeb61b4e478368aed4497ebb1c50b",
  "url": "https://discuss.hashicorp.com/t/hcsec-2026-41-vault-vulnerable-to-arbitrary-code-execution-via-plugin-catalog-entries-restored-from-raft-snapshots/77813",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "HCSEC-2026-41 - Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots",
    "summary": "Vault may execute a binary outside the configured plugin directory when a privileged operator restores a Raft snapshot. The issue requires Shamir seals and a configured external plugin directory; auto-unseal clusters and clusters without a configured plugin directory are not affected.",
    "evidence": "A plugin catalog entry introduced without going through registration, such as through a restored snapshot, could reference a binary outside the plugin directory. Vault could then execute that binary as the Vault service user when the plugin was used",
    "products": [
      {
        "name": {
          "value": "Vault Community Edition",
          "evidence": "Vault Community Edition 2.1.2"
        },
        "prerequisites": [
          {
            "value": "using Shamir seals with an external plugin directory configured",
            "evidence": "This issue only affects clusters using Shamir seals with an external plugin directory configured."
          }
        ],
        "fixed_versions": [
          {
            "value": "2.1.2",
            "evidence": "Vault Community Edition 2.1.2"
          }
        ],
        "affected_versions": [
          {
            "value": "up to 2.1.1",
            "evidence": "Vault Community Edition and Vault Enterprise up to 2.1.1"
          }
        ]
      },
      {
        "name": {
          "value": "Vault Enterprise",
          "evidence": "Vault Enterprise 2.1.2"
        },
        "prerequisites": [
          {
            "value": "using Shamir seals with an external plugin directory configured",
            "evidence": "This issue only affects clusters using Shamir seals with an external plugin directory configured."
          }
        ],
        "fixed_versions": [
          {
            "value": "2.1.2",
            "evidence": "Vault Enterprise 2.1.2"
          },
          {
            "value": "1.21.12",
            "evidence": "Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
          },
          {
            "value": "1.20.17",
            "evidence": "Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
          },
          {
            "value": "1.19.23",
            "evidence": "Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
          }
        ],
        "affected_versions": [
          {
            "value": "up to 2.1.1",
            "evidence": "Vault Community Edition and Vault Enterprise up to 2.1.1"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [
      {
        "cve": "CVE-2026-105816",
        "product": "Vault Community Edition",
        "evidence": "This vulnerability (CVE-2026-105816) is fixed in Vault Community Edition 2.1.2"
      },
      {
        "cve": "CVE-2026-105816",
        "product": "Vault Enterprise",
        "evidence": "This vulnerability (CVE-2026-105816) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
      }
    ],
    "related_cves": [
      {
        "value": "CVE-2026-105816",
        "evidence": "This vulnerability (CVE-2026-105816) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-hashicorp-discuss-security",
  "document_id": 24001,
  "published_at": "2026-10-07T21:34:25+00:00"
}