{"affected":[{"defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"product":"Vault","source":"CNA: HashiCorp","vendor":"HashiCorp","versions":[{"lessThan":"2.2.2","status":"affected","version":"1.2.0","versionType":"semver"}]},{"defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"product":"Vault Enterprise","source":"CNA: HashiCorp","vendor":"HashiCorp","versions":[{"changes":[{"at":"1.19.25","status":"unaffected"},{"at":"1.21.14","status":"unaffected"}],"lessThan":"2.2.2","status":"affected","version":"1.2.0","versionType":"semver"}]}],"cveId":"CVE-2026-92735","cwes":["CWE-918"],"description":"HashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow an unauthenticated attacker with network access to a new, uninitialized node to cause that node to send credentials from its server environment to an attacker-controlled server. This vulnerability (CVE-2026-92735) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.9,"severity":"medium","source":"CNA: HashiCorp","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1794522704506,"publishedAt":1794522704506,"references":[{"source":"CNA: HashiCorp","tags":[],"url":"https://discuss.hashicorp.com/t/hcsec-2026-55-vault-integrated-storage-join-may-disclose-server-environment-credentials/78198"}],"remediation":[],"revision":"ab98651ccfe7894eb42a309c6fb3eece643fdd0a847131c8b314b83673ba283b","sources":[{"modifiedAt":1794522704506,"name":"CNA: HashiCorp","retrievedAt":1794524944130,"url":"https://www.cve.org/CVERecord?id=CVE-2026-92735"}],"ssvc":null,"status":"published","title":"Vault integrated storage join may disclose server environment credentials","updatedAt":1794524944130}