{"id":"CVE-2026-4525","state":"PUBLISHED","title":"Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header","description":"If a Vault auth mount is configured to pass through the \"Authorization\" header, and the \"Authorization\" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.","publishedAt":"2026-04-17T03:00:47.561Z","updatedAt":"2026-07-15T00:52:47.241Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"HashiCorp"},"assigner":"HashiCorp","products":["HashiCorp Vault","HashiCorp Vault Enterprise"],"affected":[{"vendor":"HashiCorp","product":"Vault","defaultStatus":"unaffected","versions":[{"version":"0.11.2","status":"affected","lessThan":"2.0.0","versionType":"semver"}],"platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"repo":"https://github.com/hashicorp/vault"},{"vendor":"HashiCorp","product":"Vault Enterprise","defaultStatus":"unaffected","versions":[{"version":"0.11.2","status":"affected","lessThan":"2.0.0","changes":[{"at":"1.19.16","status":"unaffected"},{"at":"1.20.10","status":"unaffected"},{"at":"1.21.5","status":"unaffected"}],"versionType":"semver"}],"platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"repo":"https://github.com/hashicorp/vault"}],"references":["https://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344","https://access.redhat.com/security/cve/CVE-2026-4525","https://bugzilla.redhat.com/show_bug.cgi?id=2459107","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4525.json"],"weaknesses":["CWE-201"],"ingestedAt":"2026-10-29T20:12:16.098Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/4xxx/CVE-2026-4525.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-4525","state":"PUBLISHED","datePublished":"2026-04-17T03:00:47.561Z","dateUpdated":"2026-07-15T00:52:47.241Z","assignerShortName":"HashiCorp","assignerOrgId":"67fedba0-ff2e-4543-ba5b-aa93e87718cc","dateReserved":"2026-03-20T17:47:40.835Z"},"containers":{"cna":{"title":"Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header","descriptions":[{"lang":"en","value":"If a Vault auth mount is configured to pass through the \"Authorization\" header, and the \"Authorization\" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16."}],"affected":[{"vendor":"HashiCorp","product":"Vault","defaultStatus":"unaffected","versions":[{"version":"0.11.2","status":"affected","lessThan":"2.0.0","versionType":"semver"}],"platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"repo":"https://github.com/hashicorp/vault"},{"vendor":"HashiCorp","product":"Vault Enterprise","defaultStatus":"unaffected","versions":[{"version":"0.11.2","status":"affected","lessThan":"2.0.0","changes":[{"at":"1.19.16","status":"unaffected"},{"at":"1.20.10","status":"unaffected"},{"at":"1.21.5","status":"unaffected"}],"versionType":"semver"}],"platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"repo":"https://github.com/hashicorp/vault"}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344"}],"metrics":[{"cvssV3_1":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-201","description":"CWE-201: Insertion of Sensitive Information Into Sent Data","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"HashiCorp","orgId":"67fedba0-ff2e-4543-ba5b-aa93e87718cc","dateUpdated":"2026-04-17T17:22:41.255Z"},"credits":[{"lang":"en","value":"This issue was identified and reported by Oleh Konko of 1seal."}],"impacts":[{"capecId":"CAPEC-118","descriptions":[{"lang":"en","value":"CAPEC-118: Collect and Analyze Information"}]}],"source":{"advisory":"HCSEC-2026-08","discovery":"EXTERNAL"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-17T13:19:26.452614Z","id":"CVE-2026-4525","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-17T13:19:32.463Z"}},{"title":"Vault: Vault: Information disclosure of authentication tokens via incorrect header handling","descriptions":[{"lang":"en","value":"A flaw was found in Vault. When a Vault authentication mount is configured to pass through the \"Authorization\" header, and this header is used for authentication, Vault incorrectly forwards the sensitive Vault token to the authentication plugin backend. This can lead to the disclosure of authentication tokens to potentially untrusted or compromised backend plugins, enabling unauthorized access or further system compromise."}],"affected":[{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-baremetal-installer-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-installer-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat Openshift Data Foundation 4","packageName":"cephcsi-rhel8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_data_foundation:4"]},{"vendor":"Red Hat","product":"Red Hat Openshift Data Foundation 4","packageName":"cephcsi-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_data_foundation:4"]},{"vendor":"Red Hat","product":"Red Hat Openshift Data Foundation 4","packageName":"mcg-cli-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_data_foundation:4"]},{"vendor":"Red Hat","product":"Red Hat Openshift Data Foundation 4","packageName":"mcg-rhel8-operator","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_data_foundation:4"]},{"vendor":"Red Hat","product":"Red Hat Openshift Data Foundation 4","packageName":"mcg-rhel9-operator","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_data_foundation:4"]},{"vendor":"Red Hat","product":"Red Hat Openshift Data Foundation 4","packageName":"ocs4/cephcsi-rhel8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_data_foundation:4"]},{"vendor":"Red Hat","product":"Red Hat Openshift Data Foundation 4","packageName":"odf4/cephcsi-rhel8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_data_foundation:4"]},{"vendor":"Red Hat","product":"Red Hat Openshift Data Foundation 4","packageName":"odf4/cephcsi-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_data_foundation:4"]},{"vendor":"Red Hat","product":"Red Hat Openshift Data Foundation 4","packageName":"odf4/mcg-cli-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_data_foundation:4"]},{"vendor":"Red Hat","product":"Red Hat Openshift Data Foundation 4","packageName":"odf4/mcg-rhel8-operator","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_data_foundation:4"]},{"vendor":"Red Hat","product":"Red Hat Openshift Data Foundation 4","packageName":"odf4/mcg-rhel9-operator","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_data_foundation:4"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-4525","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2459107","name":"RHBZ#2459107","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4525.json","tags":["x_sadp-csaf-vex"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-201","description":"Insertion of Sensitive Information Into Sent Data","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-07-15T00:52:47.241Z"},"datePublic":"2026-04-17T03:00:47.561Z","timeline":[{"lang":"en","time":"2026-04-17T04:01:24.934Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-04-17T03:00:47.561Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}