HCSEC-2026-40 - Vault PKI ACME Default Directory Policy May Issue Certificates With Unverified Identities

Bulletin ID: HCSEC-2026-40 Affected Products / Versions: Vault Community Edition 1.14.0 up to 2.1.1; fixed in Vault Community Edition 2.1.2. Vault Enterprise 1.14.0 up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Publication Date: October 7, 2026 Summary Vault’s PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling impersonation toward systems that trust certificates issued by the affected Vault PKI mount. This vulnerability (CVE-2026-105818) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Background Vault’s PKI secrets engine can act as an ACME server, allowing clients to request certificates automatically after proving control of the requested identifiers through ACME challenges. ACME challenges verify control of DNS names and IP addresses. Requests that are not associated with a specific role are governed by the default_directory_policy setting, which defaults to sign-verbatim. See the PKI ACME documentation for more information. Details When the default_directory_policy was set to sign-verbatim (the default, which also applies if the setting is not configured), Vault could include subject alternative name types other than DNS names and IP addresses from the certificate signing request in the issued certificate, even though these identities are never verified by ACME challenges. An ACME client that completes validation for an identifier it controls could therefore obtain a certificate that also asserts other identities. This issue only affects PKI mounts with ACME enabled and using the sign-verbatim default directory policy, either explicitly or by default. Mounts that disable the default directory or set it to a role that constrains these subject alte…