UpHeron
All vulnerabilities

Servers and applications

CVE-2026-93335

Vault vulnerable to ACL deny bypass via trailing slash

Severity
Medium 6.5
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
2.2.2
Weakness
CWE-647
Attack
Over the network · Needs an administrator account · No user action needed
Attacker can
Change data · Take it down
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Sources
CVE Program

Description

Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engine, auth method, or audit device that a more specific deny rule was intended to protect. This vulnerability (CVE-2026-93335) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.

From the CVE Program.

Affected software

SoftwareAffected versions
HashiCorp VaultServers and applications · cna:hashicorp|vault
  • From 0.2.0 before 2.2.2
HashiCorp VaultServers and applications · cna:hashicorp|vault enterprise
  • From 0.2.0 before 2.2.2

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-93335