Critical Vulnerability CVE-2026-8715 Discovered in HashiCorp Vault Secrets Operator
HashiCorp has disclosed a critical vulnerability in its Vault Secrets Operator product that affects the AppRole authentication mechanism introduced in version 1.3.0. The flaw, tracked as CVE-2026-8715, stems from insufficient path validation in the secretIDPath field, allowing authenticated Kubernetes users to read arbitrary files from Pod filesystems. With a CVSS v3.1 base score of 9.6, the issue is rated Critical and can lead to credential theft by exfiltrating secrets to attacker-controlled endpoints. Exploitation requires specific permissions to create or retrieve VaultAuth, VaultConnection, and VaultStaticSecret resources. HashiCorp recommends immediate migration to version 1.5.0, which removes the vulnerable secretIDPath field entirely.
Security NEXTAug 17, 2026Translated from Japanese