CVE-2026-93333 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Vault's audit devices did not validate a configured audit log prefix or consistently enforce the server setting that restricts prefixing. A privileged operator can inject content into audit logs, producing forged or misleading audit records.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running HashiCorp Vault with audit devices enabled, especially where operators with privileged access configure audit log prefixes. Exposure depends on a privileged operator being able to set the prefix; the sources do not say how commonly that is granted. Deployments that do not use audit log prefixes are less exposed.
Not affected if audit-prefix-unused, managed-hosting
Who cares kubernetes, self-hosted, vault
vault version and compare it to the fixed releases below.2.2.22.2.2, 1.21.14, 1.19.25Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading audit records. This vulnerability (CVE-2026-93333) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.