HashiCorp — Security Activity Report

Terraform, Vault, Consul, Nomad

Generated Aug 20, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗

CVE Disclosure Volume

Total all-time: 44 CVEs with HashiCorp advisories. Source: NVD CVE records joined with vendor advisory publish dates.

Severity Composition

↑ +1.0 pp

54.5% of HashiCorp's 44 CVEs are CRITICAL or HIGH severity. Industry median: 53.6%. Source: NVD CVSS v3.1.

CRITICAL 3 (6.8%)HIGH 21 (47.7%)MEDIUM 20 (45.5%)

CISA KEV Listings

↓ -0.9 pp

0 of 44 HashiCorp CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (0.0%). Industry median: 0.9%.

Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.

Vendor Patch Velocity

Insufficient data to publish a reliable patch-velocity metric for HashiCorp(sample size: 1, minimum required: 10).

Top Recurring Weakness Classes

Most-frequently mapped CWEs across HashiCorp's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.

CWE-770Allocation of Resources Without Limits or Throttling10 CVEs
CWE-59Improper Link Resolution Before File Access (Link Following)7 CVEs
CWE-22Path Traversal6 CVEs
CWE-862Missing Authorization3 CVEs
CWE-863Incorrect Authorization3 CVEs

Recent Security Advisories

Latest advisories published by HashiCorp, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.

HCSEC-2026-30
Aug 18, 2026
HCSEC-2026-30 - Updates to HashiCorp subprocessors
vendor source ↗
HCSEC-2026-29
Aug 17, 2026
HCSEC-2026-29 - Packer vulnerable to arbitrary file write via crafted plugin archive during installation
CVE-2026-19589 vendor source ↗
HCSEC-2026-28
Aug 13, 2026
HCSEC-2026-28 - Vault Secrets Operator vulnerable to arbitrary file read via AppRole secretIDPath
CVE-2026-8715 vendor source ↗
HCSEC-2026-27
Aug 10, 2026
HCSEC-2026-27 - Vault Enterprise vulnerable to cross-namespace entity deletion
CVE-2026-14886 vendor source ↗
HCSEC-2026-26
Aug 10, 2026
HCSEC-2026-26 - Vault vulnerable to LIST authorization bypass via trailing-slash strip
CVE-2026-12624 vendor source ↗
HCSEC-2026-25
Aug 7, 2026
HCSEC-2026-25 - Multiple vulnerabilities impacting HashiCorp Consul
CVE-2026-15970 CVE-2026-19113 CVE-2026-19017 CVE-2026-15972 CVE-2026-19012 CVE-2026-19014+2 more CVEsvendor source ↗
HCSEC-2026-24
Jul 29, 2026
HCSEC-2026-24 - Multiple vulnerabilities impacting HashiCorp Consul MCP Server
CVE-2026-16328 CVE-2026-16326 vendor source ↗
HCSEC-2026-23
Jul 28, 2026
HCSEC-2026-23 - Multiple vulnerabilities impacting HashiCorp Terraform MCP Server
CVE-2026-14869 CVE-2026-16496 CVE-2026-16498 vendor source ↗

Full advisory archive: /pulse/vendor-advisories →

Data sources & corrections

NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
Vendor security advisories (RHSA, USN, MSRC, GHSA, etc.) — published_at timestamps
MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings

Snapshot generated Aug 20, 2026. Industry medians refresh every 6 hours; raw vendor counts are queried live on each request.

Spot a factual error in this report?

Email [email protected] with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.