HCSEC-2026-40 - Vault PKI ACME Default Directory Policy May Issue Certificates With Unverified Identities

{
  "id": "c13d801c3d934ec80fb5a4e2ad5803ce1c05566de99e911affd7c3693b26721c",
  "url": "https://discuss.hashicorp.com/t/hcsec-2026-40-vault-pki-acme-default-directory-policy-may-issue-certificates-with-unverified-identities/77812",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "HCSEC-2026-40 - Vault PKI ACME Default Directory Policy May Issue Certificates With Unverified Identities",
    "summary": "Vault’s PKI ACME server could issue certificates containing identity claims that ACME challenges do not verify when the default directory policy used sign-verbatim. The issue affects qualifying PKI mounts; the release fixes reject requests containing these unverified subject alternative name types. Until upgrading, operators can mitigate by using a restrictive role or disabling the default directory.",
    "evidence": "Vault’s PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy.",
    "products": [
      {
        "name": {
          "value": "Vault Community Edition",
          "evidence": "Vault Community Edition 1.14.0 up to 2.1.1; fixed in Vault Community Edition 2.1.2."
        },
        "prerequisites": [
          {
            "value": "PKI mounts with ACME enabled and using the sign-verbatim default directory policy, either explicitly or by default",
            "evidence": "This issue only affects PKI mounts with ACME enabled and using the sign-verbatim default directory policy, either explicitly or by default."
          },
          {
            "value": "Where external account binding is required, exploitation is limited to clients holding a valid binding.",
            "evidence": "Where external account binding is required, exploitation is limited to clients holding a valid binding."
          }
        ],
        "fixed_versions": [
          {
            "value": "2.1.2",
            "evidence": "Vault Community Edition 1.14.0 up to 2.1.1; fixed in Vault Community Edition 2.1.2."
          }
        ],
        "affected_versions": [
          {
            "value": "1.14.0 up to 2.1.1",
            "evidence": "Vault Community Edition 1.14.0 up to 2.1.1; fixed in Vault Community Edition 2.1.2."
          }
        ]
      },
      {
        "name": {
          "value": "Vault Enterprise",
          "evidence": "Vault Enterprise 1.14.0 up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
        },
        "prerequisites": [
          {
            "value": "PKI mounts with ACME enabled and using the sign-verbatim default directory policy, either explicitly or by default",
            "evidence": "This issue only affects PKI mounts with ACME enabled and using the sign-verbatim default directory policy, either explicitly or by default."
          },
          {
            "value": "Where external account binding is required, exploitation is limited to clients holding a valid binding.",
            "evidence": "Where external account binding is required, exploitation is limited to clients holding a valid binding."
          }
        ],
        "fixed_versions": [
          {
            "value": "2.1.2",
            "evidence": "Vault Enterprise 1.14.0 up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
          },
          {
            "value": "1.21.12",
            "evidence": "Vault Enterprise 1.14.0 up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
          },
          {
            "value": "1.20.17",
            "evidence": "Vault Enterprise 1.14.0 up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
          },
          {
            "value": "1.19.23",
            "evidence": "Vault Enterprise 1.14.0 up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
          }
        ],
        "affected_versions": [
          {
            "value": "1.14.0 up to 2.1.1",
            "evidence": "Vault Enterprise 1.14.0 up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [
      {
        "cve": "CVE-2026-105818",
        "product": "Vault Community Edition",
        "evidence": "This vulnerability (CVE-2026-105818) is fixed in Vault Community Edition 2.1.2"
      },
      {
        "cve": "CVE-2026-105818",
        "product": "Vault Enterprise",
        "evidence": "This vulnerability (CVE-2026-105818) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
      }
    ],
    "related_cves": [
      {
        "value": "CVE-2026-105818",
        "evidence": "This vulnerability (CVE-2026-105818) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-hashicorp-discuss-security",
  "document_id": 24002,
  "published_at": "2026-10-07T21:18:47+00:00"
}