HIGHCVSS v3.1 8.7Vulnerability
CVE-2026-13303
HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue outbound requests to a network destination of the requester's choosing and to receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service. This vulnerability, CVE-2026-13303, is fixed in Boundary Enterprise 1.0.2 and 0.21.6.
Properties
- Severity
- HIGH
- Nvd fetched at
- 2026-10-29T23:55:15.109400+00:00
- Cvss severity
- HIGH
- Cvss score
- 8.7
- Retrieved at
- 2026-10-29T23:55:48+00:00
- Score
- 8.7
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-13303
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
- First seen by Signal
- 2026-10-29T23:55:48+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
- Published at
- 2026-10-29T21:17:22.000
- Last modified
- 2026-10-29T21:17:22.000
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph