HackZoneLabs News
Newsletter

CVE-2026-93333

Vault audit device prefix vulnerable to log injection

  • Low 2.7

Description

Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading audit records. This vulnerability (CVE-2026-93333) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.

Key facts

Published
12 Nov 2026
Last changed
13 Nov 2026
Assigned by
HashiCorp
EPSS
0.231% likely to be exploited in the next 30 days, higher than 14.067% of CVEs (scores for 15 Nov 2026)
SSVC (CISA)
Exploitation: none; Automatable: no; Technical impact: partial

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

  • 2.7CVSS 3.1, Lowfrom the CNA (HashiCorp)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

CAPEC-39: Log Injection-Tampering-Forging (CNA impact statement)

No explicit remediation statement is available on this page yet. Consult the original record and vendor references before choosing a fix.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

VendorProductVersions
HashiCorpVault
  • Default status: unaffected
  • 0.7.0 up to but excluding 2.2.2 (affected)
HashiCorpVault Enterprise
  • Default status: unaffected
  • 0.7.0 up to but excluding 2.2.2 (affected); at 1.19.25 unaffected, at 1.20.0 affected, at 1.21.14 unaffected, at 2.0.0 affected

Timeline

  1. 12 Nov 2026 Published

Weakness

References