{"id":"CVE-2026-93333","kind":"vulnerability","aliases":["CVE-2026-93333"],"related":[],"title":"HashiCorp Vault: audit log prefix lets a privileged operator forge log entries","description":"Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading audit records. This vulnerability (CVE-2026-93333) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.","summary":"Vault's audit devices did not validate a configured audit log prefix or consistently enforce the server setting that restricts prefixing. A privileged operator can inject content into audit logs, producing forged or misleading audit records.","severity":"low","cvss":2.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kubernetes","self-hosted","vault"],"not_affected_if":["audit-prefix-unused","managed-hosting"],"how_to_check":"- Check the Vault version with `vault version` and compare it to the fixed releases below.\n- Review whether audit log prefixes are configured on audit devices and whether the server-level prefix restriction setting is in use.","fix":"- Vault Community Edition: `2.2.2`\n- Vault Enterprise: `2.2.2`, `1.21.14`, `1.19.25`","status":"open","published_at":"2026-11-13T00:20:18+00:00","first_seen_at":"2026-11-13T00:41:07+00:00","triaged_at":"2026-11-13T00:41:30+00:00","updated_at":"2026-11-13T00:41:30+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T00:41:30Z","model":"claude-haiku-5-5","output":{"fix":"- Vault Community Edition: `2.2.2`\n- Vault Enterprise: `2.2.2`, `1.21.14`, `1.19.25`","reach":"local","title":"HashiCorp Vault: audit log prefix lets a privileged operator forge log entries","impact":"low","summary":"Vault's audit devices did not validate a configured audit log prefix or consistently enforce the server setting that restricts prefixing. A privileged operator can inject content into audit logs, producing forged or misleading audit records.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["vault","self-hosted","kubernetes"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"privileged operator forges or misleads audit log records","analyst_note":"","how_to_check":"- Check the Vault version with `vault version` and compare it to the fixed releases below.\n- Review whether audit log prefixes are configured on audit devices and whether the server-level prefix restriction setting is in use.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["managed-hosting","audit-prefix-unused"],"who_is_affected":"Teams running HashiCorp Vault with audit devices enabled, especially where operators with privileged access configure audit log prefixes. Exposure depends on a privileged operator being able to set the prefix; the sources do not say how commonly that is granted. Deployments that do not use audit log prefixes are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000738,"input_tokens":4645,"output_tokens":547,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A,114C '-93333':15A,18A,115C '1.19.25':129C '1.21.14':127C '2.2.2':122C,126C 'allow':93C 'audit':3A,27B,34B,53B,59B,63C,73C,88C,101C,109C 'communiti':120C 'configur':33B,72C 'consist':38B,79C 'content':51B,69C,99C 'cve':13A,16A,113C 'devic':28B,64C 'edit':121C 'enforc':39B,80C 'enterpris':125C 'entri':12A 'fix':117C 'forg':10A,56B,106C 'hashicorp':1A 'host':23B 'infrastructur':19B 'inject':50B,98C 'kubernet':20B 'lead':104C 'let':6A 'level':84C 'log':4A,11A,35B,54B,74C,89C,102C 'may':92C 'mislead':58B,108C 'oper':9A,48B,96C 'potenti':103C 'prefix':5A,36B,45B,75C,90C 'privileg':8A,47B,95C 'produc':55B 'record':60B,110C 'restrict':44B,87C 'self':22B 'self-host':21B 'server':41B,83C 'server-level':82C 'set':42B,85C 'valid':31B,67C 'vault':2A,24B,25B,61C,119C,124C 'vulner':112C","nicknames":[],"mitigations":[],"who_affected":"Teams running HashiCorp Vault with audit devices enabled, especially where operators with privileged access configure audit log prefixes. Exposure depends on a privileged operator being able to set the prefix; the sources do not say how commonly that is granted. Deployments that do not use audit log prefixes are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","kubernetes","low","selfhosted","vault"],"campaign_type":null,"search_a":"'-2026':14A,17A '-93333':15A,18A 'audit':3A 'cve':13A,16A 'entri':12A 'forg':10A 'hashicorp':1A 'let':6A 'log':4A,11A 'oper':9A 'prefix':5A 'privileg':8A 'vault':2A","search_b":"'audit':27B,34B,53B,59B 'configur':33B 'consist':38B 'content':51B 'devic':28B 'enforc':39B 'forg':56B 'host':23B 'infrastructur':19B 'inject':50B 'kubernet':20B 'log':35B,54B 'mislead':58B 'oper':48B 'prefix':36B,45B 'privileg':47B 'produc':55B 'record':60B 'restrict':44B 'self':22B 'self-host':21B 'server':41B 'set':42B 'valid':31B 'vault':24B,25B","search_c":"'-2026':114C '-93333':115C '1.19.25':129C '1.21.14':127C '2.2.2':122C,126C 'allow':93C 'audit':63C,73C,88C,101C,109C 'communiti':120C 'configur':72C 'consist':79C 'content':69C,99C 'cve':113C 'devic':64C 'edit':121C 'enforc':80C 'enterpris':125C 'fix':117C 'forg':106C 'inject':98C 'lead':104C 'level':84C 'log':74C,89C,102C 'may':92C 'mislead':108C 'oper':96C 'potenti':103C 'prefix':75C,90C 'privileg':95C 'record':110C 'restrict':87C 'server':83C 'server-level':82C 'set':85C 'valid':67C 'vault':61C,119C,124C 'vulner':112C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T22:30:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security@hashicorp.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93333","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93333","severity":null,"published_at":"2026-11-13T00:20:18+00:00","modified_at":"2026-11-13T00:20:18+00:00","first_seen_at":"2026-11-13T00:41:07+00:00","fetched_at":"2026-11-13T00:41:07+00:00","note":null}],"documents":[{"id":140019,"url":"https://discuss.hashicorp.com/t/hcsec-2026-57-vault-audit-device-prefix-vulnerable-to-log-injection/78200","title":"HashiCorp security: HCSEC-2026-57 - Vault audit device prefix vulnerable to log injection","kind":"vendor","source":"vendor","publisher":null,"text":"HCSEC-2026-57 - Vault audit device prefix vulnerable to log injection\n\nBulletin ID: HCSEC-2026-57 Affected Products / Versions: Vault and Vault Enterprise up to 2.2.1; fixed in Vault 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25. Publication Date: November 12, 2026 Summary Vault’s audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading audit records. This vulnerability (CVE-2026-93333) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25. Background Vault audit devices record requests and responses for operational and security review, and support an optional prefix that is prepended to each audit log entry. Because audit logs are relied upon as a trusted record of activity, Vault provides the allow_audit_log_prefixing server configuration parameter, which is disabled by default and is intended to prevent audit devices from using prefixes unless an administrator explicitly allows it. Details Vault did not reject control characters or line separator characters in an audit log prefix. Because the prefix is written ahead of every audit entry, a crafted prefix could cause log consumers to interpret a single audit entry as multiple records, potentially allowing fabricated entries to appear alongside legitimate ones. In addition, the allow_audit_log_prefixing parameter was only enforced for file audit devices, so socket and syslog audit devices could be configured with a prefix even when the parameter was disabled. This issue requires an authenticated operator with privileges to enable audit devices. File audit devices are only affected when allow_audit_log_prefixing is enabled. Remediation Customers should evaluate the risk associated with this issue and consider upgrading to Vault Community Edition 2.2.2 or Vault Enterprise 2.2.2, 1.21.14, or 1.19.25. After upgrading, existing audit devices configured with a prefix will continue to operate without the prefix if allow_audit_log_prefixing is disabled or if the prefix contains disallowed characters. Acknowledgement This issue was reported to HashiCorp by Tal Vaknin, Independent Security Researcher. We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see https://hashicorp.com/security . 1 post - 1 participant Read full topic","published_at":"2026-11-12T22:30:40+00:00","relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}