CVE-2026-13303

{
  "etk_id": "ETK-2026-3014",
  "cve_id": "CVE-2026-13303",
  "display_id": "CVE-2026-13303",
  "ghsa_id": "GHSA-ff4v-fpcj-mjf6",
  "euvd_id": "EUVD-2026-113390",
  "status": "in_pipeline",
  "anchor_state": "anchored",
  "title": "Server-side request forgery in Boundary Vault credential stores",
  "summary": "Boundary and Boundary Enterprise deployments using the Vault credential-store integration are affected. An authenticated user granted project permissions to manage credential stores and credential libraries could make the controller access network destinations reachable from the controller and obtain responses. Exploitation depends on those management permissions and a reachable target service.",
  "mitigation": "Upgrade affected deployments to fixed release 1.0.2 or 0.21.6, as applicable to the deployed release track. Until upgraded, limit credential-store and credential-library management permissions and restrict controller outbound network access.",
  "vendor": "HashiCorp",
  "product": "Boundary",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.21.3, < *"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "*"
      ],
      "package_name": "Boundary",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.21.3, < 1.0.2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.0.2"
      ],
      "package_name": "Boundary Enterprise",
      "purl": null
    }
  ],
  "cwes": [
    918
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 54.0320519,
  "t0_at": "2026-10-29T21:03:41.322000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-29T21:03:41.322000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-29T21:03:41.322000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13303"
    }
  }
}