Aller au contenu
en Se connecter
7.2 Élevée

CVE-2026-89322 Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and…

Description

Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy, potentially leading to privilege escalation. This vulnerability (CVE-2026-89322) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.

Produits et versions touchés

Produit Versions touchées Corrigé en
Vault 0.0 0.0.1 → < 2.1.2 2.1.2
Vault Enterprise 0.0 0.0.1 → < 2.1.2 2.1.2

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Vault

Les 43 CVE de Vault →
CVE-2026-105816 Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within… 8.0 Élevée CVE-2026-105818 Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when… 5.9 Moyenne CVE-2026-5006 A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may… 6.8 Moyenne CVE-2026-12624 Vault’s ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a… 4.3 Moyenne
Suivre cette CVE