Main Vulnerability Database Vulnerabilities #VU145119

Improper Authorization in Vault Enterprise and Vault - CVE-2026-5006

Published: August 25, 2026

Vulnerability identifier: #VU145119

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-5006

CWE-ID: CWE-285

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to access unintended Vault paths.

The vulnerability exists due to improper access control in templated policy paths when rendering identity values containing slash characters. A remote user can manipulate a referenced identity value to access unintended Vault paths.

Exploitation requires control over an identity value referenced by an applicable templated policy.

Affected software

Vault Enterprise
Vault

How to mitigate CVE-2026-5006

Install security update from vendor's website.

Vault Enterprise - addressed in versions 1.19.20, 1.20.14, 1.21.9, 2.0.4
Vault - update to 2.0.4

External References

https://discuss.hashicorp.com/t/hcsec-2026-32-vault-vulnerable-to-privilege-escalation-via-slash-injection-in-templated-policy-paths/77678

Related Security Bulletins