Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability stems from how audit events were processed. The key changes in the patch show:
This demonstrates the original code processed events in a way that allowed cross-contamination between audit devices. The EntryFormatter.Process function was responsible for formatting audit data and passed the modified event to subsequent sinks, meaning any device with 'log_raw' enabled would leave raw data in the shared event payload that other devices could access.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/hashicorp/vault | go | >= 1.15.0, < 1.15.5 | 1.15.5 |
