Signals
Back to database
Schedule32Medium5.9VulnerabilityCVE-2026-105818No patch link observed

CVE-2026-105818 — Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under…

Published Oct 7, 2026, 10:17 PM UTCIngested 1d agoSource NVD(cve-db)CVE-2026-105818

Description

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling impersonation toward systems that trust certificates issued by the affected Vault PKI mount. This vulnerability (CVE-2026-105818) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.

CVSS v3.1 base metrics

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
5.9

Medium severity

Band computed from the CVSS base score, not the source's own label — so it means the same thing across every feed.

AV

Network

Attack Vector

AC

High

Attack Complexity

PR

None

Privileges Required

UI

None

User Interaction

S

Unchanged

Scope

C

None

Confidentiality

I

High

Integrity

A

None

Availability

References

Related threats

same CWE or vendor
Medium

CVE-2026-13257 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an a…

CVE-2026-13257 · 10h ago

Medium

CVE-2026-103517 — The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the…

CVE-2026-103517 · 14h ago

Low

CVE-2026-107284 — The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.

CVE-2026-107284 · 1d ago

High

PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing

CVE-2026-61428 · 1d ago

Critical

CVE-2026-107102 — This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API…

CVE-2026-107102 · 2d ago

High

CVE-2026-82212 — The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the …

CVE-2026-82212 · 2d ago