Policy Bypass Vulnerability in HashiCorp Vault Products

CVE-2026-3605

What is CVE-2026-3605?

An authenticated user with access to the kvv2 path may exploit a flaw in access policies using glob patterns to inadvertently delete secrets they lack permissions to manage. This could result in disruptions of service due to the inability to access critical secret metadata, although the vulnerability does not permit unauthorized reading of secrets across namespaces.

References