Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths (CVE-2026-5006) | HOL Guard CVE