Aller au contenu
en Se connecter
8.1 Élevée

CVE-2026-3605 An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they…

Description

An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

Produits et versions touchés

Produit Versions touchées Corrigé en
Vault 0.10 0.10.0 → < 2.0.0 2.0.0
Vault Enterprise 0.10 0.10.0 → < 2.0.0 2.0.0
Red Hat Openshift Data Foundation 4 Versions non publiées
Red Hat OpenShift Container Platform 4 Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Vault

Les 43 CVE de Vault →
CVE-2026-89322 Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and… 7.2 Élevée CVE-2026-105816 Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within… 8.0 Élevée CVE-2026-105818 Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when… 5.9 Moyenne CVE-2026-5006 A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may… 6.8 Moyenne
Suivre cette CVE