CVE-2026-5807
Published: 17 April 2026
Summary
CVE-2026-5807 is a high-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Hashicorp Vault. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 11.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Deeper analysis
CVE-2026-5807 is a denial-of-service vulnerability in HashiCorp Vault, affecting versions prior to Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0. The issue stems from a design limitation where only a single in-progress operation slot exists for sensitive workflows like root token generation or rekey operations. An unauthenticated attacker can exploit this by repeatedly initiating or canceling these operations, thereby occupying the slot and blocking legitimate administrators from completing them. The vulnerability is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-770 (Allocation of Resources Without Limits or Throttling).
Any unauthenticated attacker with network access to the Vault server can exploit this vulnerability remotely with low complexity and no user interaction required. By sending repeated requests to start or abort root token generation or rekey processes, the attacker monopolizes the single operation slot, rendering these critical administrative functions unavailable to authorized users. This results in a denial-of-service condition specifically targeting Vault's high-privilege workflows, though it does not enable data access, modification, or escalation of privileges.
The HashiCorp security advisory (HCSEC-2026-08) confirms the vulnerability and states that it is fully addressed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0. Security practitioners are advised to upgrade to these patched versions immediately, as no workarounds are mentioned for affected releases. Additional details are available in the official discussion at https://discuss.hashicorp.com/t/hcsec-2026-08-vault-vulnerable-to-denial-of-service-via-unauthenticated-root-token-generation-rekey-operations/77345.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23362
Vulnerability details
Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate operators from completing these workflows. This vulnerability, CVE-2026-5807, is…
more
fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote unauthenticated DoS achieved by exploiting a resource allocation flaw (single operation slot) in Vault's admin workflows, directly enabling application or system exploitation to deny availability.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the DoS vulnerability by implementing protections against resource exhaustion from repeated unauthenticated requests to occupy the single operation slot.
Protects the availability of critical resources like the single in-progress operation slot from unauthorized depletion by attackers performing repeated initiations or cancellations.
Monitors and controls communications at external boundaries to limit or detect excessive network requests targeting sensitive Vault workflows.