CVE-2026-89322
Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions
CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th
Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy, potentially leading to privilege escalation. This vulnerability (CVE-2026-89322) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.
| CWE | CWE-178 |
| Vendor | hashicorp |
| Product | vault |
| Published | Oct 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for hashicorp vault
Be the first to know when new high vulnerabilities affecting hashicorp vault are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
HashiCorp / Vault
0.0.1 < 2.1.2
HashiCorp / Vault Enterprise
0.0.1 < 2.1.2
References
Credits
This issue was reported to HashiCorp by Han Sang-Kyung (HAN-BAMBO) and by additional internal and external parties.