HashiCorp Boundary: Server-side request forgery in Vault credential store
Summary
HashiCorp Boundary and Boundary Enterprise contain a server-side request forgery in the Vault credential store integration. An authenticated user who can manage credential stores and credential libraries within a project can make the Boundary controller send requests to a destination of their choice and receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service.
Affected
- HashiCorp Boundary Enterprise 0.21.3 up to 1.0.1
- HashiCorp Boundary (open source) 0.21.3 and later, fixed version unknown
- Distribution packages may list 0.21.2 or 0.19.0; verify against the vendor range
Fixed in
- HashiCorp Boundary Enterprise 1.0.2
- HashiCorp Boundary Enterprise 0.21.6
- Fixed release for the open-source edition: Unknown.
Workaround
- Vendor workarounds: None found.
- Restrict who can create or change Vault credential stores and credential libraries.
- Review existing credential stores and libraries for unexpected addresses or paths.
- Restrict outbound network access from the controller, especially to link-local metadata addresses, and enforce IMDSv2 or equivalent on cloud hosts.
Exploitation
- CVSS 8.7 (CNA score, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N); VulDB scores it lower (4.7).
- Authentication with high privileges is required.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No evidence of exploitation in the wild and no public proof of concept found at the time of research.
- EPSS 0.22 % (percentile 13).
Our recommendation
- Check whether Boundary is in use and whether the controller is reachable from untrusted networks.
- Upgrade Boundary Enterprise to 1.0.2 or 0.21.6, and verify the fixed release for the open-source edition with HashiCorp.
- Until patched, limit credential store and credential library management to trusted administrators.
- Review cloud controllers for metadata service exposure and monitor outbound requests from the controller.
- If Boundary is not used, no action is needed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HashiCorp advisory HCSEC-2026-54 discuss.hashicorp.com
- CVE data and CNA details (threatint) cve.threatint.com
- Strix CVE record www.strix.ai
- VulDB entry vuldb.com
- NixOS tracker issue github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:35.
Original description (NVD)
HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue outbound requests to a network destination of the requester's choosing and to receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service. This vulnerability, CVE-2026-13303, is fixed in Boundary Enterprise 1.0.2 and 0.21.6.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.