CVE-2026-13303: Boundary vulnerable to server-side request forgery in Vault credential store
Vulnerability summary
CVE-2026-13303 is a high (CVSS 8.7) Server-Side Request Forgery vulnerability in hashicorp boundary. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 12.9% of scored vulnerabilities.
Not severe (CVSS 8.7, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 29-10-2026PublishedVulnerability first disclosed.
- 30-10-2026Last modifiedVulnerability information updated.
Description
HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue outbound requests to a network destination of the requester's choosing and to receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service. This vulnerability, CVE-2026-13303, is fixed in Boundary Enterprise 1.0.2 and 0.21.6.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST8.7HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
EPSS trend
Probability
0.22%
Chance of exploitation in the next 30 days
Percentile
13%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Hashicorp2 products
- boundary≥ 0.21.3 (No fix recorded)
- boundary enterprise≥ 0.21.3, < 1.0.2
1 vendor · 2 products