CVE-2026-105816

{
  "etk_id": "ETK-2026-913",
  "cve_id": "CVE-2026-105816",
  "display_id": "CVE-2026-105816",
  "ghsa_id": "GHSA-pw8v-gjgv-3j42",
  "euvd_id": "EUVD-2026-94646",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Arbitrary code execution through Vault plugin catalog entries",
  "summary": "Vault and Vault Enterprise can accept plugin catalog references that resolve outside the configured plugin directory. A privileged operator who can restore an Integrated Storage (Raft) snapshot may cause code to run on the Vault host when Shamir seals and an external plugin directory are in use.",
  "mitigation": "Upgrade Vault Community Edition or Vault Enterprise to version 2.1.2 or later. For Enterprise deployments remaining on supported release branches, upgrade to 1.21.12, 1.20.17, or 1.19.23; restrict Raft snapshot restoration privileges until upgraded.",
  "vendor": "HashiCorp",
  "product": "Vault",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.0.1, < 2.1.2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.1.2"
      ],
      "package_name": "Vault",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.0.1, < 2.1.2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.1.2"
      ],
      "package_name": "Vault Enterprise",
      "purl": null
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": 0.0034,
  "epss_percentile": 0.2554,
  "epss_asof": "2026-10-21",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 21.252858483333334,
  "t0_at": "2026-10-07T21:37:03.913000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-07T22:36:28.762188+00:00",
      "days": 0.04125982856481481,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T21:37:03.913000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-07T21:37:03.913000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T21:37:03.913000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105816"
    }
  }
}