NVD security advisoryHigh
High advisory for HashiCorp Boundary and Boundary Enterpri
CVE-2026-13303 · Reported 29 Oct 2026
Full advisory details, affected packages, severity context, and original source.
Affected technology
HashiCorp Boundary and Boundary EnterpriAffected product
Advisory overview
HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue outbound requests to a network destination of the requester's choosing and to receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service. This vulnerability, CVE-2026-13303, is fixed in Boundary Enterprise 1.0.2 and 0.21.6.