CVE-2026-5807

What it actually does

An unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot and blocking legitimate completion of these workflows.

Why it matters to the business

Critical security maintenance tasks such as root token generation and rekeying become unavailable, delaying incident response and operational changes in widely deployed Vault instances.

How an attack unfolds

An attacker issues repeated unauthenticated requests to start or abort root token generation or rekey operations, holding the single operation slot and preventing authorized users from completing the workflows.

How to fix it

Upgrade HashiCorp Vault Community Edition and Enterprise Edition to version 2.0.0.

How to confirm the fix worked

Confirm the installed version is 2.0.0 or later and verify that concurrent root token or rekey operations are properly serialized and rejected when a slot is occupied.

Typical attack path

1. Issue unauthenticated API calls to begin root token generation or rekey
2. Immediately cancel or repeat the request to retain the slot
3. Continue the cycle to block legitimate operators indefinitely

How to detect it

Examine Vault audit logs for high volumes of root token generation or rekey operation start and cancel events originating from unauthenticated clients.

What your security team should do

• Upgrade all Vault deployments to 2.0.0 at the earliest maintenance window
• Review audit logs for anomalous volumes of root token or rekey operation requests
• Restrict unauthenticated access to Vault endpoints where operationally feasible