CVE-2026-13303
Description
HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue outbound requests to a network destination of the requester's choosing and to receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service. This vulnerability, CVE-2026-13303, is fixed in Boundary Enterprise 1.0.2 and 0.21.6.
How to fix
- HashiCorp Boundary Enterprise1.0.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| HashiCorp Boundary | 0.21.3 | — |
| HashiCorp Boundary Enterprise | 0.21.3 ≤ v < 1.0.2 | 1.0.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.