Vault

2 posts tagged with “Vault”

CVE-2026-5006: Vault Privilege Escalation via Slash Injection in Templated Policy Paths
cvevaulthashicorp

CVE-2026-5006: Vault Privilege Escalation via Slash Injection in Templated Policy Paths

How to fix CVE-2026-5006: upgrade HashiCorp Vault Community Edition to 2.0.4 (Enterprise 2.0.4, 1.21.9, 1.20.14, or 1.19.20), then set deny_slash_in_templated_paths = true. Templated policy paths interpolate identity values. A slash in a controlled identity value becomes extra path segments and can grant capabilities the author did not intend. The deny-slash option defaults to false even after upgrade.

Aug 24, 2026
Read
CVE-2026-12624: HashiCorp Vault LIST Authorization Bypass via Trailing Slash
cvesecurityvulnerability

CVE-2026-12624: HashiCorp Vault LIST Authorization Bypass via Trailing Slash

CVE-2026-12624 lets a Vault token enumerate secrets beneath a path a deny policy was supposed to block. The ACL engine failed to enforce wildcard deny rules on LIST requests with a trailing slash. Fixed in Vault 2.0.3.

Aug 12, 2026
Read