CVE-2026-92735 · Infrastructure
NO FIX YET · SEE WHAT TO DO
A new, uninitialized Vault node can be made to send credentials from its server environment to an attacker-controlled server during the integrated storage join process. An unauthenticated attacker with network access to that node can trigger it.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running HashiCorp Vault with integrated (Raft) storage, especially when new nodes are joined to a cluster. The risk is an uninitialized node reachable over the network by an unauthenticated attacker. Deployments where new nodes are only joined over a private, trusted network are less exposed.
Not affected if managed-hosting, no-integrated-storage
Who cares kubernetes, self-hosted, vault
vault version on each Vault server and compare against the fixed versions.2.2.22.2.2, 1.21.14, 1.19.25HashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow an unauthenticated attacker with network access to a new, uninitialized node to cause that node to send credentials from its server environment to an attacker-controlled server. This vulnerability (CVE-2026-92735) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.