UpHeron
All vulnerabilities

Servers and applications

CVE-2026-92738

Expired Vault login MFA requests may remain redeemable

Severity
Medium 6.8
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
2.2.2
Weakness
Insufficient session expiration (CWE-613)
Attack
Over the network · Only under certain conditions · Needs a user account · No user action needed
Attacker can
Read data · Change data
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Sources
CVE Program

Description

Vault's Login MFA feature did not consistently enforce the lifetime of pending two-phase login requests. This may allow a user who previously completed the first authentication factor to complete MFA and obtain a Vault token after the pending request should have expired, including after the user's primary credential has been rotated. This vulnerability (CVE-2026-92738) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.26.

From the CVE Program.

Affected software

SoftwareAffected versions
HashiCorp VaultServers and applications · cna:hashicorp|vault
  • From 1.10.0 before 2.2.2
HashiCorp VaultServers and applications · cna:hashicorp|vault enterprise
  • From 1.10.0 before 2.2.2

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-92738