CVE-2026-5807

High

Published: 17 April 2026

Published

17 April 2026

Modified

27 April 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0003 7.9th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-5807 is a high-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Hashicorp Vault. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 7.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).

Threat & Defense at a Glance

What attackers do: exploitation maps to Application or System Exploitation (T1499.004). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SC-5 Denial-of-service Protection good match

prevent

Directly addresses the DoS vulnerability by implementing protections against resource exhaustion from repeated unauthenticated requests to occupy the single operation slot.

SC-6 Resource Availability good match

prevent

Protects the availability of critical resources like the single in-progress operation slot from unauthorized depletion by attackers performing repeated initiations or cancellations.

SC-7 Boundary Protection partial match

preventdetect

Monitors and controls communications at external boundaries to limit or detect excessive network requests targeting sensitive Vault workflows.

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

The vulnerability is a remote unauthenticated DoS achieved by exploiting a resource allocation flaw (single operation slot) in Vault's admin workflows, directly enabling application or system exploitation to deny availability.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate operators from completing these workflows. This vulnerability, CVE-2026-5807, is…

fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0.

Deeper analysisAI

CVE-2026-5807 is a denial-of-service vulnerability in HashiCorp Vault, affecting versions prior to Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0. The issue stems from a design limitation where only a single in-progress operation slot exists for sensitive workflows like root token generation or rekey operations. An unauthenticated attacker can exploit this by repeatedly initiating or canceling these operations, thereby occupying the slot and blocking legitimate administrators from completing them. The vulnerability is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-770 (Allocation of Resources Without Limits or Throttling).

Any unauthenticated attacker with network access to the Vault server can exploit this vulnerability remotely with low complexity and no user interaction required. By sending repeated requests to start or abort root token generation or rekey processes, the attacker monopolizes the single operation slot, rendering these critical administrative functions unavailable to authorized users. This results in a denial-of-service condition specifically targeting Vault's high-privilege workflows, though it does not enable data access, modification, or escalation of privileges.

The HashiCorp security advisory (HCSEC-2026-08) confirms the vulnerability and states that it is fully addressed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0. Security practitioners are advised to upgrade to these patched versions immediately, as no workarounds are mentioned for affected releases. Additional details are available in the official discussion at https://discuss.hashicorp.com/t/hcsec-2026-08-vault-vulnerable-to-denial-of-service-via-unauthenticated-root-token-generation-rekey-operations/77345.