CVE-2026-105820

Received Received - Intake

ACL Policy Cache Namespace Traversal in Vault Enterprise

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: HashiCorp Inc.

Description

Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability (CVE-2026-105820) is fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Vault Community Edition does not support namespaces, and is not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-07

Generated

2026-10-08

AI Q&A

2026-10-08

EPSS Evaluated

N/A

NVD

CVE-2026-105820

Affected Vendors & Products

Vendor	Product	Version / Range
HashiCorp	Vault	Enterprise 0.0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This could let a token with a specially crafted policy name use capabilities from policies in other namespaces, including the root namespace.

Detection Guidance

This vulnerability affects Vault Enterprise with namespaces enabled. To detect it, check Vault server versions for affected releases (2.1.2, 1.21.12, 1.20.17, 1.19.23) and review policy names for path traversal constructs like '../'. Use Vault CLI commands such as 'vault version' to verify versions and 'vault policy list' to inspect policy names. Ensure no policies contain '../' or similar patterns.

Impact Analysis

An attacker with access to a token assigned a malicious policy name could gain unauthorized access to resources or permissions defined in other namespaces, potentially leading to data breaches or privilege escalation.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection and access control in standards like GDPR and HIPAA.

Mitigation Strategies

Upgrade Vault Enterprise to version 2.1.2, 1.21.12, 1.20.17, or 1.19.23 or later. Vault Community Edition is not affected as it does not support namespaces.

Hi! I’m here to help you understand CVE-2026-105820. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70