Hashicorp Boundary Enterprise vulnerabilities

3 vulnerabilities

Known vulnerabilities in Hashicorp Boundary Enterprise, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8HighCVE-2024-1052Gogithub.com/hashicorp · boundary +2 moreBoundary Vulnerable to Session Hijacking Through TLS Certificate TamperingBoundary and Boundary Enterprise (“Boundary”) is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use (TOFU) token may craft a TLS certificate to hijack an active session and gain access to the underlying service or application.EPSS0.29%5.9MediumCVE-2024-12289Gogithub.com/hashicorp · boundary +2 moreBoundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of ServiceBoundary Community Edition and Boundary Enterprise (“Boundary”) incorrectly handle HTTP requests during the initialization of the Boundary controller, which may cause the Boundary server to terminate prematurely. Boundary is only vulnerable to this flaw during the initialization of the Boundary controller, which on average is measured in milliseconds during the Boundary startup process. This vulnerability, CVE-2024-12289, is fixed in Boundary Community Edition and Boundary Enterprise 0.16.4, 0.17.3, 0.18.2.EPSS0.39%7.5HighCVE-2026-7776Gogithub.com/hashicorp · boundary +2 moreBoundary Workers Vulnerable to Denial of Service During TLS HandshakeBoundary Community Edition and Boundary Enterprise (“Boundary”) workers are vulnerable to a denial-of-service condition during node enrollment TLS handshakes. An attacker with network access to the worker authentication listener may open a connection and delay or withhold the client certificate during the TLS handshake, causing worker connection handling to block. This may prevent legitimate worker connections from being accepted or routed. This vulnerability, CVE-2026-7776, is fixed in Boundary 0.21.3, 0.20.3, 0.19.5.EPSS0.34%