CVE-2026-4525CWE-201

Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header

High · published April 17, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
47.3
In the wild
Unconfirmed
What it is

If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00586 · 47.3th percentile
Weakness
CWE-201 · Insertion of Sensitive Information Into Sent Data
Published
2026-04-17T03:00Z
EPSS history
Timeline
  • 17 APR 03:00Z
    Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header
    cvelistv5