UpHeron
All vulnerabilities

Servers and applications

CVE-2026-93333

Vault audit device prefix vulnerable to log injection

Severity
Low 2.7
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
2.2.2
Weakness
CWE-117
Attack
Over the network · Needs an administrator account · No user action needed
Attacker can
Change some data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Sources
CVE Program

Description

Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading audit records. This vulnerability (CVE-2026-93333) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.

From the CVE Program.

Affected software

SoftwareAffected versions
HashiCorp VaultServers and applications · cna:hashicorp|vault
  • From 0.7.0 before 2.2.2
HashiCorp VaultServers and applications · cna:hashicorp|vault enterprise
  • From 0.7.0 before 2.2.2

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-93333