HashiCorp Tooling

consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules

Go-getter may allow to arbitrary filesystem reads through git operations

also in 2 other products

HashiCorp Tooling: Files or Directories Accessible to External Parties

terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

also in 1 other product

consul-mcp-server vulnerable to server side request forgery leading to token exposure

terraform-mcp-server vulnerable to server side request forgery leading to token exposure

also in 1 other product

HashiCorp Tooling: Session Fixation

also in 1 other product

Consul-template vulnerable to an information disclosure issue in error handling

Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method

HashiCorp Hermes Improperly Validates AWS ALB JWTs, which May Lead to Authentication Bypass

also in 1 other product

Consul-template is vulnerable to path redirection in writeToFile through symlink attack

Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack