TL;DR: HashiCorp Vault Enterprise contains an authorization bypass that allows a token scoped to one namespace to access secrets in a different namespace. The vulnerability stems from insufficient namespace boundary enforcement in the policy evaluation path, breaking the isolation model that multi-tenant Vault deployments depend on for secret segregation.

Who is affected

HashiCorp Vault is a secrets management platform used by thousands of organizations to store and control access to tokens, passwords, certificates, API keys, and encryption keys. Vault Enterprise adds multi-namespace support, which lets organizations partition a single Vault cluster into isolated tenants. Each namespace has its own policies, tokens, and secret engines. The entire security model assumes that a token in namespace A cannot read secrets in namespace B unless an explicit cross-namespace policy grants that access.

Data from multiple technology intelligence sources puts Vault adoption between 689 and 22,000 organizations worldwide. Major users include Walmart, NVIDIA, and IBM. The Business Services sector has the highest concentration of Vault deployments, followed by finance and technology. For these organizations, namespace isolation is not a convenience feature. It is the boundary that prevents a developer in one business unit from reading production database credentials owned by another.

This CVE affects Vault Enterprise deployments that use multiple namespaces. Open-source Vault (Community Edition) does not support namespaces and is not affected. The vulnerability exists in the policy evaluation layer, so any token type (batch, service, or recovery) scoped to a namespace with a permissive policy configuration is a potential traversal vector.

What happened

Vault Enterprise evaluates policies on every API request. When a client presents a token, Vault checks the token's namespace, loads the policies attached to that token, and evaluates whether the policy grants the requested path. The bug is in how the namespace boundary interacts with relative path resolution in certain policy configurations.

Under specific conditions, a policy that grants access to a path in namespace A can be satisfied by a path in namespace B if the request uses a crafted relative path. Vault's internal path resolver follows the traversal across the namespace boundary instead of rejecting it. The token's namespace scope is not re-validated after resolution, so the request succeeds.

The result: a client authenticated to namespace A can read, write, or list secrets in namespace B, depending on the capabilities granted by their policy. This breaks the core tenet of Vault Enterprise. The namespace is supposed to be a hard security boundary, not a soft hint.

The attack requires an authenticated token with at least one mounted secret engine accessible in its home namespace. The attacker does not need admin privileges. A standard read-only policy on a single path in namespace A is enough to attempt the traversal. If the policy configuration on the target namespace B is permissive enough, the traversal succeeds.

What to do

Check your Vault version. HashiCorp has not yet published a fixed version at time of writing. Monitor the HashiCorp security advisories page for the patch release.

In the interim, apply these mitigations:

Audit namespace policies. Review every policy attached to every namespace. Remove wildcard path grants (path "*" { capabilities = ["read"] }) and replace them with explicit path lists. Wildcard policies amplify the impact of this bypass because they grant broad access within the home namespace, which the traversal can then expand across namespace boundaries.

Restrict token TTLs. Reduce token time-to-live to limit the window during which a compromised token can perform cross-namespace access. Short-lived tokens reduce the blast radius.

Enable audit logging. If you have not already, enable Vault audit devices in every namespace. The audit log records the full request path, which will show the relative path traversal if it occurs. Forward audit logs to a SIEM and alert on requests where the resolved path namespace differs from the token namespace.

Network segmentation. If your architecture permits, run separate Vault clusters for different trust levels instead of relying on namespace isolation within a single cluster. This is a defense-in-depth measure, not a fix, but it limits the attacker's reachable surface to a single cluster's secrets.

Why it matters

Vault Enterprise namespaces exist because organizations need to share a single secrets management platform across teams, business units, or even external customers without those parties being able to read each other's secrets. A managed service provider running Vault Enterprise for multiple clients depends on namespace isolation as the trust boundary. A cross-namespace bypass means a client in tenant A can read tenant B's database credentials, TLS private keys, and API tokens.

This is the category of vulnerability that does not need exploitation in the wild to cause damage. The existence of the bypass means that compliance certifications that depend on namespace isolation (SOC 2, PCI DSS multi-tenant scoping) may be invalidated retroactively. Organizations subject to these frameworks need to assess whether the bypass was exploitable during their audit window.

Not in CISA KEV. No known exploitation at time of writing. NVD enrichment is pending; no CVSS score has been assigned yet.

References

• CVE-2026-14886 on hol.org
• Vault Enterprise Namespaces Documentation
• HashiCorp Security Advisories