HCSEC-2026-55 - Vault integrated storage join may disclose server environment credentials

Bulletin ID: HCSEC-2026-55 Affected Products / Versions: Vault and Vault Enterprise up to 2.2.1; fixed in Vault 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25. Publication Date: November 12, 2026 Summary HashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow an unauthenticated attacker with network access to a new, uninitialized node to cause that node to send credentials from its server environment to an attacker-controlled server. This vulnerability (CVE-2026-92735) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25. Background Vault’s integrated storage lets a new node join an existing cluster by contacting a leader node, either at an address supplied by an operator or through cloud auto-join, which discovers leader nodes using a cloud provider’s API. Because a new node has not yet been initialized, the join API on that node does not require authentication. Cloud auto-join can authenticate to the cloud provider using credentials available in the Vault server’s environment, which are intended to be sent only to the cloud provider endpoints an operator has configured. Details Vault’s join API accepted cloud auto-join discovery settings supplied in an unauthenticated request. For discovery providers that allow the provider API endpoint to be specified and that read credentials from the server environment, an attacker could direct the node to send those credentials to a server under the attacker’s control. In addition, when contacting a leader node specified in a join request, Vault included any Vault token, and in Vault 1.18.0 and later any custom headers, configured through the VAULT_TOKEN and VAULT_HEADERS environment variables of the Vault server process. The issue requires network access to the API listener of a node that uses integrated storage and has not yet been initialized, but does not require authentication. Exposure depends on such cre…