{"id":"CVE-2026-92738","aliases":[],"cve":{"records":[{"id":"CVE-2026-92738","source":"HashiCorp","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-16T18:24:56.544Z","published":"2026-11-13T20:23:30.733Z","modified":"2026-11-13T21:09:35.483Z"}],"publishers":[{"name":"HashiCorp","role":"CNA","organizationId":"67fedba0-ff2e-4543-ba5b-aa93e87718cc","modified":"2026-11-13T20:23:30.733Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T21:09:35.483Z"}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-59-expired-vault-login-mfa-requests-may-remain-redeemable/78257","tags":[],"source":"HashiCorp"}],"weaknesses":[{"id":"CWE-613","description":"CWE-613: Insufficient Session Expiration","source":"HashiCorp"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T21:09:27.624686Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Expired Vault login MFA requests may remain redeemable","titleSource":"HashiCorp","descriptionSource":"HashiCorp","description":"Vault's Login MFA feature did not consistently enforce the lifetime of pending two-phase login requests. This may allow a user who previously completed the first authentication factor to complete MFA and obtain a Vault token after the pending request should have expired, including after the user's primary credential has been rotated. This vulnerability (CVE-2026-92738) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.26.","score":6.8,"severity":"medium","published":"2026-11-13T20:23:30.733Z","modified":"2026-11-13T21:09:35.483Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"HashiCorp","name":"Vault","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"versions":[{"version":"1.10.0","status":"affected","lessThan":"2.2.2","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"HashiCorp","url":"https://www.cve.org/CVERecord?id=CVE-2026-92738"},{"vendor":"HashiCorp","name":"Vault Enterprise","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"versions":[{"version":"1.10.0","status":"affected","lessThan":"2.2.2","versionType":"semver","changes":[{"at":"1.19.26","status":"unaffected"},{"at":"1.20.0","status":"affected"},{"at":"1.21.14","status":"unaffected"},{"at":"2.0.0","status":"affected"}]}],"defaultStatus":"unaffected","cpes":[],"source":"HashiCorp","url":"https://www.cve.org/CVERecord?id=CVE-2026-92738"}],"remediation":[],"references":["https://discuss.hashicorp.com/t/hcsec-2026-59-expired-vault-login-mfa-requests-may-remain-redeemable/78257"],"sources":[{"name":"CVE","id":"CVE-2026-92738","modified":"2026-11-13T21:09:35.483Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-92738"}],"assessments":[{"source":"HashiCorp","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","score":6.8}],"sourceAffected":[],"observedAt":"2026-11-13T21:42:21.402Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:30:32.029Z"},"coverage":[{"source":"NVD","status":"refresh-failed","attemptedAt":"2026-11-13T20:55:33.298Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-13T20:50:34.521Z","attemptedAt":"2026-11-13T20:50:34.521Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-13T20:50:33.977Z","attemptedAt":"2026-11-13T20:50:33.977Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-13T20:50:33.673Z","attemptedAt":"2026-11-13T20:50:33.673Z"}],"evidence":[],"aiSummary":{"text":"HashiCorp Vault's Login MFA feature may not enforce the lifetime of pending requests, allowing users to complete MFA after the request should have expired. This affects Vault versions before 2.2.2, 1.21.14, and 1.19.26. An attacker with previous authentication factor completion may obtain a Vault token.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T20:56:03.831Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-92738"}]}}