CVE-2026-128100
Vault vulnerable to ACL deny bypass via case-variant auth method user and group names
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
Vault Community Edition and Vault Enterprise did not apply explicit ACL policy deny rules to letter case variants of user and group names in auth methods that treat these names as case-insensitive. This may allow an authenticated user with delegated permissions to modify a protected user or group, potentially leading to privilege escalation. This vulnerability (CVE-2026-128100) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.
| CWE | CWE-178 |
| Vendor | hashicorp |
| Product | vault |
| Published | Nov 13, 2026 |
| Last Updated | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for hashicorp vault
Be the first to know when new medium vulnerabilities affecting hashicorp vault are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
HashiCorp / Vault
0.10.0 < 2.2.2
HashiCorp / Vault Enterprise
0.10.0 < 2.2.2
References
Credits
This issue was reported to HashiCorp by Chase Bevan-Thomas.