Loading vulnerability…
Denial of Service in HashiCorp Vault root token generation and rekey operations
CVE-2026-5807 is a denial-of-service vulnerability in HashiCorp Vault caused by unauthenticated access to administrative endpoint families used for root token generation, rekey, and DR secondary operation-token generation. Vault permits only a single in-progress operation for these workflows. An unauthenticated remote attacker with network access to the Vault API can repeatedly initiate or cancel these operations and monopolize the single operation slot, preventing legitimate operators from completing root token generation or rekey ceremonies. The issue is a resource-management and access-control design flaw affecting availability of critical administrative functions. Affected versions include Vault Community Edition up to 1.21.4 and Vault Enterprise up to 1.21.4, 1.20.9, and 1.19.15. The issue is fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an unauthenticated attacker to deny availability of sensitive Vault administrative workflows, specifically root token generation ceremonies, rekey operations, and related DR operation-token generation workflows. This can block incident response, emergency recovery, key rotation after suspected compromise, and other operational procedures that depend on those functions. The vulnerability affects availability only; the provided information does not indicate direct confidentiality or integrity impact.
If you can’t patch tonight, do this now.
Restrict network access to the Vault API so untrusted parties cannot reach the affected administrative endpoints. Ensure unauthenticated access to the relevant endpoint families is not enabled. In environments using Vault 2.0.0 or later, do not configure the backward-compatibility setting that restores unauthenticated access for generate-root, generate-operation-token, or rekey operations unless absolutely necessary, as doing so reintroduces the risk. Additional compensating controls include limiting exposure to trusted management networks and monitoring for repeated initiation or cancellation of these workflows.
Patch, then assume compromise.
Upgrade to a fixed release: Vault Community Edition 2.0.0 or Vault Enterprise 2.0.0. In the fixed versions, these administrative endpoint families require a valid Vault token by default, removing unauthenticated access that enabled the denial-of-service condition. No backported fix is available for the 1.x release lines based on the available information.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.