CVE-2026-4525
If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Va
CVSS
7.5
High
EPSS
0.4%
p33
KEV
—
Exploit Today
10
0-100
Published: Apr 17, 2026 · Last modified: Jul 15, 2026 · CWE-201
0.4%EPSS · 30 days0.4%
2026-06-302026-07-21
If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
- discuss.hashicorp.comhttps://discuss.hashicorp.com/t/hcsec-2026-07-vault-may-expose-tokens-to-auth-plugins-due-to-incorrect-header-sanitization/77344
- access.redhat.comhttps://access.redhat.com/security/cve/CVE-2026-4525
- bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2459107
- security.access.redhat.comhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4525.json
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-13380—17.8%
——5VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server.19hCVE-2026-541716.5 MED36.2%
——11Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.1dCVE-2026-74887.5 HIG15.7%
——5Insertion of sensitive information into sent data vulnerability in IKAS Technology Inc. E-Commerce allows Retrieve Embedded Sensitive Data.
This issue affects E-Commerce: through 03062026.4dCVE-2026-71897.5 HIG15.7%
——5Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's OBS allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Proliz's OBS: before v3.6.0.4dCVE-2026-449703.1 LOW10.7%
——3dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emit_tool_called_event() in src/dbt_mcp/tracking/tracking.py serialized every MCP tool call's complete arguments dictionary and sent it through dbtlabs_vortex.producer.log_proto without redaction, including sql_query from show, vars from run, build, and test, and node_selection from compile, while usage_tracking_enabled in settings.py enabled telemetry by default unless DBT_SEND_ANONYMOUS_USAGE_STATS=false or DO_NOT_TRACK=1 was set. This issue is fixed in version 1.17.1.4dCVE-2026-564606.5 MED30.3%
——9HCL DevOps Deploy / HCL Launch could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attacks against the system.8d