Hashicorp Packer vulnerabilities

2 CVEs affecting Hashicorp Packer, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-19589, published 2026-08-17.

More from Hashicorp.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-15869, published 2018-08-25. Medium severity, CVSS 5.3. EPSS: 1.8% chance of exploitation in the next 30 days. An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security…
• CVE-2026-19589, published 2026-08-17. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin…