CVE-2026-14886

Received Received - Intake

Cross-Namespace Authorization Bypass in Vault Enterprise

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: HashiCorp Inc.

Description

Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability (CVE-2026-14886) is fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-14886

EUVD

EUVD-2026-55738

Affected Vendors & Products

Vendor	Product	Version / Range
hashicorp	vault_enterprise	2.0.4
hashicorp	vault_enterprise	1.21.9
hashicorp	vault_enterprise	1.20.14
hashicorp	vault_enterprise	1.19.20

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Vault Enterprise has a flaw in its identity entity batch-delete endpoint. An authenticated user in one namespace can exploit this to permanently delete the storage of entities in another namespace. This is due to a cross-namespace authorization bypass.

Impact Analysis

This vulnerability allows unauthorized deletion of critical data across namespaces. If exploited, it could lead to permanent data loss, disrupting operations and causing service outages. Affected entities may lose access to their storage permanently.

Compliance Impact

This vulnerability could lead to unauthorized data deletion, violating integrity and availability requirements in GDPR and HIPAA. Permanent data loss may result in non-compliance, potential fines, and reputational damage due to failed audits or breaches of data protection obligations.

Mitigation Strategies

Upgrade Vault Enterprise to a fixed version (2.0.4, 1.21.9, 1.20.14, or 1.19.20) immediately to address the cross-namespace authorization bypass vulnerability.

Hi! I’m here to help you understand CVE-2026-14886. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70