Inconsistent ACL Policy Evaluation in HashiCorp Vault and Vault Enterprise
CVE-2026-89322

7.2HIGH

Key Information:

Vendor

Hashicorp
Status
Vault
Vault Enterprise
Vendor
CVE Published:
7 October 2026

What is CVE-2026-89322?

HashiCorp Vault and Vault Enterprise exhibit a vulnerability where ACL policies may not be evaluated consistently against the canonical forms of resource and policy names. This flaw allows an authenticated user with delegated permissions to potentially bypass explicit deny restrictions, leading to unauthorized access to protected resources or the ability to assign denied policies. Such behavior could result in privilege escalation, posing significant security threats to organizations utilizing these products.

Affected Version(s)

Vault 64 bit 0.0.1 < 2.1.2

Vault Enterprise 64 bit 0.0.1 < 2.1.2

References

https://discuss.hashicorp.com/t/hcsec-2026-43-vault-incon...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was reported to HashiCorp by Han Sang-Kyung (HAN-BAMBO) and by additional internal and external parties.
.