{"id":"CVE-2026-13303","aliases":[],"cve":{"records":[{"id":"CVE-2026-13303","source":"HashiCorp","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-06-24T23:18:07.911Z","published":"2026-10-29T21:03:41.322Z","modified":"2026-10-30T17:08:58.961Z"}],"publishers":[{"name":"HashiCorp","role":"CNA","organizationId":"67fedba0-ff2e-4543-ba5b-aa93e87718cc","modified":"2026-10-29T21:03:41.322Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T17:08:58.961Z"}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-54-boundary-vulnerable-to-server-side-request-forgery-in-vault-credential-store/77932","tags":[],"source":"HashiCorp"}],"weaknesses":[{"id":"CWE-918","description":"CWE-918: Server-Side Request Forgery (SSRF)","source":"HashiCorp"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T17:08:47.821598Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Boundary vulnerable to server-side request forgery in Vault credential store","titleSource":"HashiCorp","descriptionSource":"HashiCorp","description":"HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue outbound requests to a network destination of the requester's choosing and to receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service. This vulnerability, CVE-2026-13303, is fixed in Boundary Enterprise 1.0.2 and 0.21.6.","score":8.7,"severity":"high","published":"2026-10-29T21:03:41.322Z","modified":"2026-10-30T17:08:58.961Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"HashiCorp","name":"Boundary","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"versions":[{"version":"0.21.3","status":"affected","lessThan":"*","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"HashiCorp","url":"https://www.cve.org/CVERecord?id=CVE-2026-13303"},{"vendor":"HashiCorp","name":"Boundary Enterprise","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"versions":[{"version":"0.21.3","status":"affected","lessThan":"1.0.2","versionType":"semver","changes":[{"at":"0.21.6","status":"unaffected"}]}],"defaultStatus":"unaffected","cpes":[],"source":"HashiCorp","url":"https://www.cve.org/CVERecord?id=CVE-2026-13303"}],"remediation":[],"references":["https://discuss.hashicorp.com/t/hcsec-2026-54-boundary-vulnerable-to-server-side-request-forgery-in-vault-credential-store/77932"],"sources":[{"name":"CVE","id":"CVE-2026-13303","modified":"2026-10-30T17:08:58.961Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-13303"}],"assessments":[{"source":"HashiCorp","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","score":8.7}],"sourceAffected":[],"observedAt":"2026-10-30T18:56:06.552Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:15:35.655Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T01:25:35.031Z","attemptedAt":"2026-10-30T01:25:35.031Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T01:25:34.335Z","attemptedAt":"2026-10-30T01:25:34.335Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T01:25:33.719Z","attemptedAt":"2026-10-30T01:25:33.719Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T01:25:34.291Z","attemptedAt":"2026-10-30T01:25:34.291Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113390","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113390","modified":"Oct 29, 2026, 9:03:41 PM","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","checkedAt":"2026-10-30T01:25:33.719Z"},{"source":"GitHub Advisory Database","id":"GHSA-ff4v-fpcj-mjf6","url":"https://github.com/advisories/GHSA-ff4v-fpcj-mjf6","modified":"2026-10-29T21:31:37Z","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","checkedAt":"2026-10-30T01:25:34.335Z"},{"source":"NVD","id":"CVE-2026-13303","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13303","modified":"2026-10-29T21:17:22.000","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","checkedAt":"2026-10-30T01:25:35.031Z"}],"aiSummary":{"text":"HashiCorp Boundary and Boundary Enterprise versions before 1.0.2 and 0.21.6 are vulnerable to server-side request forgery in the Vault credential store integration, potentially allowing authenticated users to issue outbound requests to chosen network destinations. This may expose internal endpoints.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:42:41.776Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-13303"}]}}