VAULT · CVE-2026-92738 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Vault's Login MFA feature did not consistently enforce the lifetime of pending two-phase login requests. A user who passed the first factor can finish MFA after the request should have expired and get a Vault token, even after the primary credential was rotated.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running HashiCorp Vault with the Login MFA feature enabled for user logins are exposed. Vault instances that do not use Login MFA, or that only use other auth methods, are not affected by this description.
Not affected if login-mfa-disabled
Who cares hashicorp, self-hosted, vault
vault version and compare it to the fixed versions.2.2.22.2.2, 1.21.14, 1.19.26Vault's Login MFA feature did not consistently enforce the lifetime of pending two-phase login requests. This may allow a user who previously completed the first authentication factor to complete MFA and obtain a Vault token after the pending request should have expired, including after the user's primary credential has been rotated. This vulnerability (CVE-2026-92738) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.26.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.