{"id":"CVE-2026-92735","kind":"vulnerability","aliases":["CVE-2026-92735"],"related":[],"title":"HashiCorp Vault: integrated storage join can leak server environment credentials","description":"HashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow an unauthenticated attacker with network access to a new, uninitialized node to cause that node to send credentials from its server environment to an attacker-controlled server. This vulnerability (CVE-2026-92735) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.","summary":"A new, uninitialized Vault node can be made to send credentials from its server environment to an attacker-controlled server during the integrated storage join process. An unauthenticated attacker with network access to that node can trigger it.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kubernetes","self-hosted","vault"],"not_affected_if":["managed-hosting","no-integrated-storage"],"how_to_check":"- Run `vault version` on each Vault server and compare against the fixed versions.\n- Check whether any Vault node is new and uninitialized and reachable from untrusted networks.","fix":"- Vault Community Edition: `2.2.2`\n- Vault Enterprise: `2.2.2`, `1.21.14`, `1.19.25`","status":"open","published_at":"2026-11-13T00:20:18+00:00","first_seen_at":"2026-11-13T00:41:07+00:00","triaged_at":"2026-11-13T00:41:20+00:00","updated_at":"2026-11-13T00:41:20+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T00:41:20Z","model":"claude-haiku-5-5","output":{"fix":"- Vault Community Edition: `2.2.2`\n- Vault Enterprise: `2.2.2`, `1.21.14`, `1.19.25`","reach":"network","title":"HashiCorp Vault: integrated storage join can leak server environment credentials","impact":"medium","summary":"A new, uninitialized Vault node can be made to send credentials from its server environment to an attacker-controlled server during the integrated storage join process. An unauthenticated attacker with network access to that node can trigger it.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["vault","self-hosted","kubernetes"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Server environment credentials are sent to an attacker-controlled server","analyst_note":"","how_to_check":"- Run `vault version` on each Vault server and compare against the fixed versions.\n- Check whether any Vault node is new and uninitialized and reachable from untrusted networks.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["managed-hosting","no-integrated-storage"],"who_is_affected":"Teams running HashiCorp Vault with integrated (Raft) storage, especially when new nodes are joined to a cluster. The risk is an uninitialized node reachable over the network by an unauthenticated attacker. Deployments where new nodes are only joined over a private, trusted network are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000732,"input_tokens":4657,"output_tokens":533,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A,111C '-92735':13A,16A,112C '1.19.25':126C '1.21.14':124C '2.2.2':119C,123C 'access':55B,85C 'allow':79C 'attack':41B,52B,82C,105C 'attacker-control':40B,104C 'caus':92C 'communiti':117C 'control':42B,106C 'credenti':10A,33B,97C 'cve':11A,14A,110C 'edit':118C 'enterpris':65C,122C 'environ':9A,37B,101C 'fix':114C 'hashicorp':1A,61C 'host':21B 'infrastructur':17B 'integr':3A,46B,73C 'issu':70C 'join':5A,48B,75C 'kubernet':18B 'leak':7A 'made':30B 'may':78C 'network':54B,84C 'new':24B,88C 'node':27B,58B,90C,94C 'process':49B,76C 'self':20B 'self-host':19B 'send':32B,96C 'server':8A,36B,43B,100C,107C 'storag':4A,47B,74C 'trigger':60B 'unauthent':51B,81C 'uniniti':25B,89C 'vault':2A,22B,26B,62C,64C,116C,121C 'vulner':67C,109C","nicknames":[],"mitigations":[],"who_affected":"Teams running HashiCorp Vault with integrated (Raft) storage, especially when new nodes are joined to a cluster. The risk is an uninitialized node reachable over the network by an unauthenticated attacker. Deployments where new nodes are only joined over a private, trusted network are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","kubernetes","medium","selfhosted","vault"],"campaign_type":null,"search_a":"'-2026':12A,15A '-92735':13A,16A 'credenti':10A 'cve':11A,14A 'environ':9A 'hashicorp':1A 'integr':3A 'join':5A 'leak':7A 'server':8A 'storag':4A 'vault':2A","search_b":"'access':55B 'attack':41B,52B 'attacker-control':40B 'control':42B 'credenti':33B 'environ':37B 'host':21B 'infrastructur':17B 'integr':46B 'join':48B 'kubernet':18B 'made':30B 'network':54B 'new':24B 'node':27B,58B 'process':49B 'self':20B 'self-host':19B 'send':32B 'server':36B,43B 'storag':47B 'trigger':60B 'unauthent':51B 'uniniti':25B 'vault':22B,26B","search_c":"'-2026':111C '-92735':112C '1.19.25':126C '1.21.14':124C '2.2.2':119C,123C 'access':85C 'allow':79C 'attack':82C,105C 'attacker-control':104C 'caus':92C 'communiti':117C 'control':106C 'credenti':97C 'cve':110C 'edit':118C 'enterpris':65C,122C 'environ':101C 'fix':114C 'hashicorp':61C 'integr':73C 'issu':70C 'join':75C 'may':78C 'network':84C 'new':88C 'node':90C,94C 'process':76C 'send':96C 'server':100C,107C 'storag':74C 'unauthent':81C 'uniniti':89C 'vault':62C,64C,116C,121C 'vulner':67C,109C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T22:26:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@hashicorp.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92735","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92735","severity":null,"published_at":"2026-11-13T00:20:18+00:00","modified_at":"2026-11-13T00:20:18+00:00","first_seen_at":"2026-11-13T00:41:07+00:00","fetched_at":"2026-11-13T00:41:07+00:00","note":null}],"documents":[{"id":140021,"url":"https://discuss.hashicorp.com/t/hcsec-2026-55-vault-integrated-storage-join-may-disclose-server-environment-credentials/78198","title":"HashiCorp security: HCSEC-2026-55 - Vault integrated storage join may disclose server environment credentials","kind":"vendor","source":"vendor","publisher":null,"text":"HCSEC-2026-55 - Vault integrated storage join may disclose server environment credentials\n\nBulletin ID: HCSEC-2026-55 Affected Products / Versions: Vault and Vault Enterprise up to 2.2.1; fixed in Vault 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25. Publication Date: November 12, 2026 Summary HashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow an unauthenticated attacker with network access to a new, uninitialized node to cause that node to send credentials from its server environment to an attacker-controlled server. This vulnerability (CVE-2026-92735) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25. Background Vault’s integrated storage lets a new node join an existing cluster by contacting a leader node, either at an address supplied by an operator or through cloud auto-join, which discovers leader nodes using a cloud provider’s API. Because a new node has not yet been initialized, the join API on that node does not require authentication. Cloud auto-join can authenticate to the cloud provider using credentials available in the Vault server’s environment, which are intended to be sent only to the cloud provider endpoints an operator has configured. Details Vault’s join API accepted cloud auto-join discovery settings supplied in an unauthenticated request. For discovery providers that allow the provider API endpoint to be specified and that read credentials from the server environment, an attacker could direct the node to send those credentials to a server under the attacker’s control. In addition, when contacting a leader node specified in a join request, Vault included any Vault token, and in Vault 1.18.0 and later any custom headers, configured through the VAULT_TOKEN and VAULT_HEADERS environment variables of the Vault server process. The issue requires network access to the API listener of a node that uses integrated storage and has not yet been initialized, but does not require authentication. Exposure depends on such credentials being present in the Vault server’s environment. Initialized nodes, and nodes that use integrated storage only for high availability, are not affected. Remediation Customers should evaluate the risk associated with this issue and consider upgrading to Vault Community Edition 2.2.2 or Vault Enterprise 2.2.2, 1.21.14, or 1.19.25. After upgrading, the join API and the vault operator raft join command no longer accept cloud auto-join settings, so operators who rely on them should configure cloud auto-join using the retry_join stanza in the integrated storage configuration. Restricting network access to the API listener of new Vault nodes until they have joined a cluster reduces exposure to this issue. Acknowledgement This issue was reported to HashiCorp by Tal Vaknin, Independent Security Researcher. We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see https://hashicorp.com/security . 1 post - 1 participant Read full topic","published_at":"2026-11-12T22:26:40+00:00","relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}