CVE-2026-105818 in Vault
Summary
by MITRE • 10/08/2026
Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling impersonation toward systems that trust certificates issued by the affected Vault PKI mount. This vulnerability (CVE-2026-105818) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The HashiCorp Vault PKI secrets engine includes an ACME server component designed to facilitate automated certificate issuance through the Automated Certificate Management Environment protocol. This integration allows clients to obtain certificates from a trusted internal or external Certificate Authority using standard ACME workflows, which typically involve domain validation challenges such as HTTP-01, DNS-01, or TLS-ALPN-01. The core security assumption in any PKI system is that the identities listed within a certificate must be strictly validated by the CA before issuance to prevent unauthorized impersonation. In this specific vulnerability, identified as CVE-2026-105818, there was a logical flaw in how Vault processed identity claims during the ACME handshake and certificate generation phase under its default directory policy configuration.
The technical root cause of this issue lies in the separation between challenge validation and final certificate subject processing. When an ACME client initiates a request for a new certificate, it submits a Certificate Signing Request containing specific Subject Alternative Names or Common Name fields representing the desired identities. The ACME protocol requires that these identities be validated through out-of-band challenges to prove ownership of the associated domains or resources. However, in versions prior to the fix, Vault did not strictly enforce that every identity claim present in the final certificate had been successfully verified by a completed and valid ACME challenge. This oversight meant that if an attacker could initiate an ACME transaction for one validated domain, they might be able to inject additional unverified identities into the resulting certificate without those specific extra identities undergoing any validation process.
This flaw creates a significant risk of identity impersonation within environments relying on Vault PKI for mutual TLS or service mesh authentication. An adversary who gains access to an ACME-enabled endpoint could request certificates that contain validly validated domains alongside malicious, unvalidated hostnames or IP addresses. Systems configured to trust the root CA issued by this Vault mount would accept these certificates as legitimate based on their cryptographic signature and chain of trust, unaware that certain identity fields were not subject to proper ownership verification. This effectively bypasses the intended security controls designed to ensure that only authorized entities can present credentials for specific network identities, potentially allowing lateral movement or unauthorized access to sensitive services.
From a classification perspective, this vulnerability aligns with CWE-295 Improper Certificate Validation and CWE-613 Insufficient Session Expiration, as it involves the failure to properly validate identity attributes during credential issuance. In terms of MITRE ATT&CK mapping, this behavior facilitates Initial Access or Lateral Movement techniques where an attacker uses forged credentials to blend in with legitimate traffic. The impact is particularly severe in zero-trust architectures where certificate-based authentication is a primary mechanism for verifying service and user identities across distributed systems.
To mitigate this risk, organizations running affected versions of HashiCorp Vault must upgrade immediately to the patched releases: Community Edition 2.1.2 or Enterprise editions 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Until patching is complete, administrators should review ACME directory policies to ensure that strict validation rules are enforced at the policy level rather than relying solely on default configurations. Additionally, monitoring logs for unusual patterns of certificate requests containing multiple or unexpected identity claims can help detect potential exploitation attempts in real-time. It is also advisable to audit existing certificates issued through the PKI mount during the window of vulnerability to identify any that may contain unvalidated identities and revoke them proactively.