UpHeron
All vulnerabilities

Servers and applications

CVE-2026-128100

Vault vulnerable to ACL deny bypass via case-variant auth method user and group names

Severity
Medium 6.5
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
2.2.2
Weakness
Case-sensitivity mistakes (CWE-178)
Attack
Over the network · Needs an administrator account · No user action needed
Attacker can
Change data · Take it down
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Sources
CVE Program

Description

Vault Community Edition and Vault Enterprise did not apply explicit ACL policy deny rules to letter case variants of user and group names in auth methods that treat these names as case-insensitive. This may allow an authenticated user with delegated permissions to modify a protected user or group, potentially leading to privilege escalation. This vulnerability (CVE-2026-128100) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.

From the CVE Program.

Affected software

SoftwareAffected versions
HashiCorp VaultServers and applications · cna:hashicorp|vault
  • From 0.10.0 before 2.2.2
HashiCorp VaultServers and applications · cna:hashicorp|vault enterprise
  • From 0.10.0 before 2.2.2

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-128100