cvevaulthashicorp
CVE-2026-5006: Vault Privilege Escalation via Slash Injection in Templated Policy Paths
How to fix CVE-2026-5006: upgrade HashiCorp Vault Community Edition to 2.0.4 (Enterprise 2.0.4, 1.21.9, 1.20.14, or 1.19.20), then set deny_slash_in_templated_paths = true. Templated policy paths interpolate identity values. A slash in a controlled identity value becomes extra path segments and can grant capabilities the author did not intend. The deny-slash option defaults to false even after upgrade.
