HashiCorp Vulnerabilities and Affected Products
Vulnerabilities associated with Boundary Enterprise.
Products
Clear product- Vault Enterprise44 vulnerabilities
- Vault39 vulnerabilities
- Nomad Enterprise23 vulnerabilities
- Nomad21 vulnerabilities
- Consul20 vulnerabilities
- Consul Enterprise19 vulnerabilities
- Tooling11 vulnerabilities
- Shared library8 vulnerabilities
- Boundary4 vulnerabilities
- vault_enterprise4 vulnerabilities
- Boundary Enterprise3 vulnerabilities
- Terraform Enterprise3 vulnerabilities
- go-getter2 vulnerabilities
- Vagrant2 vulnerabilities
- boundary_enterprise1 vulnerability
- shared_library1 vulnerability
- Terraform1 vulnerability
- vault_community_edition1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-7776HIGH | Boundary Workers Vulnerable to Denial of Service During TLS HandshakeBoundary Community Edition and Boundary Enterprise (“Boundary”) workers are vulnerable to a denial-of-service condition during node enrollment TLS handshakes. An attacker with network access to the worker authentication listener may open a connection and delay or withhold the client certificate during the TLS handshake, causing worker connection handling to block. This may prevent legitimate worker connections from being accepted or routed. This vulnerability, CVE-2026-7776, is fixed in Boundary… CWE-770May 4, 2026 | CVSS7.5v3.1 | EPSS0.2% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-12289MEDIUM | Boundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of ServiceBoundary Community Edition and Boundary Enterprise (“Boundary”) incorrectly handle HTTP requests during the initialization of the Boundary controller, which may cause the Boundary server to terminate prematurely. Boundary is only vulnerable to this flaw during the initialization of the Boundary controller, which on average is measured in milliseconds during the Boundary startup process. This vulnerability, CVE-2024-12289, is fixed in Boundary Community Edition and Boundary Enterprise 0.16.4, 0.… | CVSS5.9v3.1 | EPSS0.378% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-1052HIGH | Boundary Vulnerable to Session Hijacking Through TLS Certificate TamperingBoundary and Boundary Enterprise (“Boundary”) is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use (TOFU) token may craft a TLS certificate to hijack an active session and gain access to the underlying service or application. CWE-295Feb 5, 2024 | CVSS8.0v3.1 | EPSS0.294% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |