HCSEC-2026-33 - HashiCorp Linux Signing GPG Key Update (CA026560)

{
  "id": "d5637cbf5894f5f35e2b6136883934f87cbcda7a2a063a6c9b2b5004cd7b24d7",
  "url": "https://discuss.hashicorp.com/t/hcsec-2026-33-hashicorp-linux-signing-gpg-key-update-ca026560/77734",
  "method": "llm",
  "payload": {
    "kind": "mitigation",
    "title": "HCSEC-2026-33 - HashiCorp Linux Signing GPG Key Update (CA026560)",
    "summary": "HashiCorp rotated its Linux package-signing key as a precaution after an incident affecting part of its internal software delivery pipeline. Customers using HashiCorp APT or RPM repositories should import the current key and replace any cached or pinned prior key.",
    "evidence": "The HashiCorp GPG key used to sign Linux packages was rotated on September 10th, 2026.",
    "products": [
      {
        "name": {
          "value": "HashiCorp software via our Linux APT or RPM repositories",
          "evidence": "Customers who install HashiCorp software via our Linux APT or RPM repositories should import our current signing GPG key"
        },
        "prerequisites": [
          {
            "value": "install HashiCorp software via our Linux APT or RPM repositories",
            "evidence": "Customers who install HashiCorp software via our Linux APT or RPM repositories should import our current signing GPG key"
          }
        ],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-hashicorp-discuss-security",
  "document_id": 24009,
  "published_at": "2026-09-10T14:39:04+00:00"
}