CVE-2026-7776: hashicorp boundary
Vulnerability summary
CVE-2026-7776 is a high (CVSS 7.5) vulnerability in hashicorp boundary. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 04-05-2026PublishedVulnerability first disclosed.
- 05-05-2026Last modifiedVulnerability information updated.
Description
Boundary Community Edition and Boundary Enterprise (“Boundary”) workers are vulnerable to a denial-of-service condition during node enrollment TLS handshakes. An attacker with network access to the worker authentication listener may open a connection and delay or withhold the client certificate during the TLS handshake, causing worker connection handling to block. This may prevent legitimate worker connections from being accepted or routed. This vulnerability, CVE-2026-7776, is fixed in Boundary 0.21.3, 0.20.3, 0.19.5.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
26%
Versus all other CVEs
30-day change
+0.14 pp
From 0.20% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Hashicorp2 products
- boundary≥ 0.9.0, < 0.21.3
- boundary enterprise≥ 0.9.0, < 0.21.3
Github.com/hashicorp1 product
- boundary< 0.19.5 | ≥ 0.20.0, < 0.20.3 | ≥ 0.21.0, < 0.21.3
2 vendors · 3 products
