CVE-2026-5006

Received Received - Intake

Path Traversal in HashiCorp Vault

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: HashiCorp Inc.

Description

A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include slash ({{/}}) characters that Vault interprets as additional path segments when rendering the policy. This vulnerability, CVE-2026-5006, was fixed in Vault Community Edition 2.0.4 and Vault Enterprise 2.0.4, 1.21.9, 1.20.14, and 1.19.20.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-08-24

Generated

2026-08-25

AI Q&A

2026-08-25

EPSS Evaluated

N/A

NVD

CVE-2026-5006

EUVD

EUVD-2026-65122

Affected Vendors & Products

Vendor	Product	Version / Range
hashicorp	vault	2.0.4
hashicorp	vault_enterprise	2.0.4
hashicorp	vault_enterprise	1.21.9
hashicorp	vault_enterprise	1.20.14
hashicorp	vault_enterprise	1.19.20

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in HashiCorp Vault allows an authenticated attacker to manipulate an identity value used in a templated policy path. By including slash characters, the attacker can trick Vault into interpreting additional path segments, potentially gaining unauthorized access to Vault paths.

Impact Analysis

If exploited, this vulnerability could allow an attacker with valid credentials to access sensitive data or perform unauthorized actions within Vault. This may lead to data breaches, privilege escalation, or compromise of critical systems depending on the Vault's configuration.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements such as GDPR or HIPAA. Organizations using affected Vault versions may face regulatory penalties, reputational damage, and increased audit scrutiny.

Mitigation Strategies

Upgrade to Vault Community Edition 2.0.4 or Vault Enterprise versions 2.0.4, 1.21.9, 1.20.14, or 1.19.20 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-5006. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70