What is the HashiCorp CNA?

HashiCorp is a CVE Numbering Authority (CNA) — an organization authorized to assign CVE IDs to vulnerabilities in its scope. It has published 81 CVE records since 2022.

How many CVEs has HashiCorp published?

HashiCorp has published 81 CVE records, including 46 in the last two years.

What is HashiCorp's CVE data quality grade?

RadicalNotion.AI grades HashiCorp's CVE data quality as A, with an overall completeness score of 100%. This reflects how consistently its CVE records include vendor (100%), product (100%), CVSS (100%), and CWE (100%) information.

What products does HashiCorp publish CVEs for?

HashiCorp most frequently publishes CVEs for Vault Enterprise, Vault, github.com/hashicorp/vault, Nomad Enterprise, Nomad.

Which vendors does HashiCorp cover?

HashiCorp publishes CVEs across 1 distinct vendors, most often HashiCorp, openbao, Red Hat, hashicorp-forge.

Is HashiCorp actively publishing CVEs?

HashiCorp is currently active, based on 46 CVEs in the last two years.

What is the average severity of HashiCorp's CVEs?

The average CVSS base score across HashiCorp's scored CVEs is 6.2.

How many critical CVEs has HashiCorp published?

HashiCorp has published 6 critical-severity CVEs and 47 high-severity CVEs.

What are the most common weakness types in HashiCorp's CVEs?

HashiCorp's CVEs most often map to these CWE weakness types: CWE-266 (Incorrect Privilege Assignment), CWE-59 (Improper Link Resolution Before File Access ('Link Following')), CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-863 (Incorrect Authorization).

How does HashiCorp rank among CNAs?

By total CVE volume, HashiCorp ranks #134 of 370 CNAs, and it reports more complete CVE records than 60% of all CNAs.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Grade A

Active

HashiCorp

Name: HashiCorp CNA CVE data quality report card
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE Numbering Authority

Latest CVE published November 21, 2025

81

CVEs published

Total assigned

3

Years active

2022–2025

6.2

Avg CVSS

Across scored CVEs

46

Recent CVEs

Last 2 years

Overview

HashiCorp is a CVE Numbering Authority that has published 81 CVE records since 2022. It is currently classified as active, with 46 CVEs published in the last two years. Its CVE data quality is graded A (100% overall completeness).

Among the 370 CNAs tracked here, HashiCorp ranks #134 by CVE volume and reports more complete records than 60% of all CNAs.

Data quality report card

How complete and consistent HashiCorp's CVE records are, scored across vendor, product, CVSS, and CWE coverage.

A CVE record only requires a description to be published. “Completeness” measures how often HashiCorp also fills in the optional — but extremely useful — fields that make a vulnerability actually actionable: the affected vendor and product, a CVSS severity score, and a CWE weakness type. A higher score means more of this CNA’s CVEs include those details, so defenders spend less time enriching records by hand.

Report card grade

A

100%

Overall score

Overall completeness100%

Vendor completeness100%

Product completeness100%

CVSS completeness100%

CWE completeness100%

98.8%

Update rate

Records revised after publishing

1

Vendor diversity

Distinct vendors covered

294 chars

Avg description length

Per CVE record

2022-11-10

First CVE date

Earliest assignment

2025-11-21

Latest CVE date

Most recent assignment

6.2

Average CVSS

Across scored CVEs

What these scores mean

Vendor completeness: The share of this CNA's CVEs that name an affected vendor.
Product completeness: The share that name a specific affected product.
CVSS completeness: The share that include a CVSS severity score.
CWE completeness: The share mapped to a CWE weakness type.
Update rate: How often this CNA revises CVE records after first publishing them.
Vendor diversity: How many distinct vendors this CNA publishes CVEs for.

Severity and exploitation

How the CVSS severity of HashiCorp's published CVEs breaks down, and how many are known to be exploited in the wild.

Critical6

High47

Medium42

Low5

In CISA’s Known Exploited Vulnerabilities catalog

0

None of HashiCorp's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Common weakness types

The CWE weakness categories HashiCorp most often assigns to its CVEs. Follow any weakness to its full explanation.

Publishing activity by year

How many CVEs HashiCorp has published each year.

2022

3

2023

29

2024

24

2025

25

2026

19

Top vendors

The vendors HashiCorp publishes the most CVEs for.

HashiCorp100 CVEs
openbao5 CVEs
Red Hat4 CVEs
hashicorp-forge1 CVEs

Top products

The products HashiCorp publishes the most CVEs for.

Vault Enterprise42 CVEs
Vault42 CVEs
github.com/hashicorp/vault37 CVEs
Nomad Enterprise23 CVEs
Nomad23 CVEs
github.com/hashicorp/nomad18 CVEs
github.com/hashicorp/consul11 CVEs
Consul11 CVEs

Latest CVEs

The most recent CVEs assigned by HashiCorp.

CVE-2026-14896CWE-863
Nomad vulnerable to cross-namespace host volume claim deletion
Medium · CVSS 4.2
EPSS 0.2%2026-07-08
CVE-2026-14361CWE-59
Consul-template is vulnerable to path redirection in writeToFile through symlink attack
Medium · CVSS 4.7
EPSS 0.1%2026-07-08
CVE-2026-14891CWE-59
Nomad vulnerable to sandbox escape in Docker task driver
High · CVSS 8.7
EPSS 0.3%2026-07-08
CVE-2026-14373CWE-862
Nomad Docker driver Linux host namespace bypass
High · CVSS 7.7
EPSS 0.2%2026-07-08
CVE-2026-14362CWE-770
Denial of service via crafted push/pull gossip message in memberlist
Medium · CVSS 4.9
EPSS 0.3%2026-07-08
CVE-2026-14468CWE-22
Path traversal allows arbitrary file read in Terraform Enterprise container
High · CVSS 7.7
EPSS 0.3%2026-07-06
CVE-2026-5051CWE-22
Audit Log Plugin Directory Guard Bypass via Legacy path Option
Medium · CVSS 4.4
EPSS 0.3%2026-07-01
CVE-2026-7474CWE-22
Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution
High · CVSS 8.8
EPSS 6.9%2026-05-12
CVE-2026-8052CWE-59
Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attack
Medium · CVSS 6.0
EPSS 0.1%2026-05-12
CVE-2026-6959CWE-59
Nomad vulnerable to arbitrary file read/write on client host through symlink attack
Medium · CVSS 6.0
EPSS 0.2%2026-05-12
CVE-2026-5061CWE-59
Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack
Medium · CVSS 4.7
EPSS 0.1%2026-05-12
CVE-2026-7776CWE-770
Boundary Workers Vulnerable to Denial of Service During TLS Handshake
High · CVSS 7.5
EPSS 0.2%2026-05-04

Track new HashiCorp CVEs as they are published and get AI-written analysis and remediation guidance.

Monitor HashiCorp CVEs

Other CNAs

Compare data quality across other CVE Numbering Authorities.

mitreGrade F · 112,208 CVEs PatchstackGrade A · 14,729 CVEs VulDBGrade A · 12,140 CVEs microsoftGrade F · 11,701 CVEs redhatGrade F · 10,745 CVEs GitHub_MGrade A · 10,605 CVEs LinuxGrade F · 10,294 CVEs WordfenceGrade A · 8,652 CVEs

Browse all CNAs

Frequently asked questions

Common questions about the HashiCorp CNA.

What is the HashiCorp CNA?: HashiCorp is a CVE Numbering Authority (CNA) — an organization authorized to assign CVE IDs to vulnerabilities in its scope. It has published 81 CVE records since 2022.
How many CVEs has HashiCorp published?: HashiCorp has published 81 CVE records, including 46 in the last two years.
What is HashiCorp's CVE data quality grade?: RadicalNotion.AI grades HashiCorp's CVE data quality as A, with an overall completeness score of 100%. This reflects how consistently its CVE records include vendor (100%), product (100%), CVSS (100%), and CWE (100%) information.
What products does HashiCorp publish CVEs for?: HashiCorp most frequently publishes CVEs for Vault Enterprise, Vault, github.com/hashicorp/vault, Nomad Enterprise, Nomad.
Which vendors does HashiCorp cover?: HashiCorp publishes CVEs across 1 distinct vendors, most often HashiCorp, openbao, Red Hat, hashicorp-forge.
Is HashiCorp actively publishing CVEs?: HashiCorp is currently active, based on 46 CVEs in the last two years.
What is the average severity of HashiCorp's CVEs?: The average CVSS base score across HashiCorp's scored CVEs is 6.2.
How many critical CVEs has HashiCorp published?: HashiCorp has published 6 critical-severity CVEs and 47 high-severity CVEs.
Are any of HashiCorp's CVEs in CISA's Known Exploited Vulnerabilities catalog?: No. None of HashiCorp's CVEs are currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
What are the most common weakness types in HashiCorp's CVEs?: HashiCorp's CVEs most often map to these CWE weakness types: CWE-266 (Incorrect Privilege Assignment), CWE-59 (Improper Link Resolution Before File Access ('Link Following')), CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-863 (Incorrect Authorization).
How does HashiCorp rank among CNAs?: By total CVE volume, HashiCorp ranks #134 of 370 CNAs, and it reports more complete CVE records than 60% of all CNAs.

References

CNA report-card grades are computed by RadicalNotion.AI from published CVE records. CVE data is sourced from the CVE Program.

Track HashiCorp CVEs

Monitor new vulnerabilities as this CNA publishes them, with AI-written analysis and remediation guidance.

Start free See pricing