{"id":"CVE-2026-13303","kind":"vulnerability","aliases":["CVE-2026-13303"],"related":[],"title":"HashiCorp Boundary: Vault integration lets authenticated users reach internal endpoints","description":"HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue outbound requests to a network destination of the requester's choosing and to receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service. This vulnerability, CVE-2026-13303, is fixed in Boundary Enterprise 1.0.2 and 0.21.6.","summary":"Boundary's Vault credential store integration can be made to send outbound requests to a destination chosen by the requester and return the response. An attacker with credential-management rights can use the controller to read services reachable only from the controller's host, such as a cloud metadata service.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["boundary","cloud-metadata","hashicorp","infrastructure","self-hosted","vault"],"not_affected_if":["managed-hosting","no-credential-manage-role","no-vault-credential-store"],"how_to_check":"- Check the Boundary version with `boundary version`\n- Check whether Vault credential stores or credential libraries are in use in your Boundary projects","fix":"- Boundary Enterprise: `1.0.2` and `0.21.6`\n- Open-source Boundary: unknown","status":"open","published_at":"2026-10-29T21:17:22+00:00","first_seen_at":"2026-10-29T21:26:52+00:00","triaged_at":"2026-10-29T21:28:34+00:00","updated_at":"2026-10-29T21:28:34+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-29T21:28:34Z","model":"claude-haiku-5-5","output":{"fix":"- Boundary Enterprise: `1.0.2` and `0.21.6`\n- Open-source Boundary: unknown","reach":"network","title":"HashiCorp Boundary: Vault integration lets authenticated users reach internal endpoints","impact":"medium","summary":"Boundary's Vault credential store integration can be made to send outbound requests to a destination chosen by the requester and return the response. An attacker with credential-management rights can use the controller to read services reachable only from the controller's host, such as a cloud metadata service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["boundary","hashicorp","vault","cloud-metadata","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Internal services and cloud metadata readable through the Boundary controller","analyst_note":"Confirm whether the open-source Boundary release has a fixed version; sources only name Boundary Enterprise 1.0.2 and 0.21.6.","how_to_check":"- Check the Boundary version with `boundary version`\n- Check whether Vault credential stores or credential libraries are in use in your Boundary projects\n- unknown for open-source Boundary fixed versions; the sources state the fix only for Boundary Enterprise","plain_action":"","needs_analyst":true,"not_affected_if":["no-vault-credential-store","no-credential-manage-role","managed-hosting"],"who_is_affected":"Only deployments of Boundary or Boundary Enterprise that use the Vault credential store integration are exposed. The attacker needs an account with permission to manage credential stores and credential libraries within a project. Teams not using the Vault integration or without such accounts are less exposed, but the sources do not say whether the flaw needs the Vault integration enabled.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000751,"input_tokens":4220,"output_tokens":658,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-13303':13A,16A,161C '-2026':12A,15A,160C '0.21.6':169C '1.0.2':167C 'allow':100C 'attack':52B 'authent':6A,102C 'boundari':2A,17B,27B,79C,81C,119C,165C 'caus':117C 'choos':133C 'chosen':43B 'cloud':19B,75B,153C 'cloud-metadata':18B 'control':61B,69B,120C,147C 'credenti':30B,55B,95C,108C,111C 'credential-manag':54B 'cve':11A,14A,159C 'destin':42B,128C 'endpoint':10A,142C 'enterpris':82C,166C 'expos':141C 'fix':163C 'forgeri':91C 'hashicorp':1A,21B,78C 'host':25B,71B,149C 'infrastructur':22B 'instanc':154C 'integr':4A,32B,97C 'intern':9A 'issu':122C 'let':5A 'librari':112C 'made':35B 'manag':56B,107C 'may':99C,140C 'metadata':20B,76B,155C 'network':127C 'outbound':38B,123C 'permiss':105C 'project':115C 'reach':8A 'reachabl':65B,143C 'read':63B 'receiv':136C 'request':39B,46B,90C,124C,131C 'respons':50B,138C 'return':48B 'right':57B 'self':24B 'self-host':23B 'send':37B 'server':88C 'server-sid':87C 'servic':64B,77B,156C 'side':89C 'store':31B,96C,109C 'use':59B 'user':7A,103C 'vault':3A,26B,29B,94C 'vulner':84C,158C 'within':113C","nicknames":[],"mitigations":[],"who_affected":"Only deployments of Boundary or Boundary Enterprise that use the Vault credential store integration are exposed. The attacker needs an account with permission to manage credential stores and credential libraries within a project. Teams not using the Vault integration or without such accounts are less exposed, but the sources do not say whether the flaw needs the Vault integration enabled.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T21:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","cvss_by":"security@hashicorp.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-13303","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13303","severity":null,"published_at":"2026-10-29T21:17:22+00:00","modified_at":"2026-10-29T21:17:22+00:00","first_seen_at":"2026-10-29T21:26:52+00:00","fetched_at":"2026-10-29T21:26:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}