CVE-2026-4525
High · 7.5CVSS
7.5
EPSS
0.6%
Published
Apr 17, 2026
CISA due date
—
The record
If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-105777 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before… CWE-201
- CVE-2026-107315 pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is… CWE-201
- CVE-2026-62088 Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress… CWE-201
- CVE-2026-81804 Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore Migration <= 2.4.2… CWE-201
- CVE-2026-78303 Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in… CWE-201
- CVE-2026-78374 Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page… CWE-201
- CVE-2026-86505 In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project… CWE-201
- CVE-2026-86497 In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without… CWE-201