CVE-2026-105816

Published 7 October 2026 · tracked since 8 October 2026

Description

Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory configured, a privileged operator able to restore an Integrated Storage (Raft) snapsh

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-107573 HIGH 7.8
• CVE-2026-107275 MEDIUM 6.8
• CVE-2026-93509 MEDIUM 6.5
• CVE-2026-104660 HIGH 7.8
• CVE-2026-104671 MEDIUM 5.3
• CVE-2026-105190 MEDIUM 5.3
• CVE-2026-103649 HIGH 7.5
• CVE-2026-103010 HIGH 7.8
• CVE-2026-103011 MEDIUM 6.5
• CVE-2026-103517 MEDIUM 5.3

→ Open the live CVE board · all tools