CVE-2026-105820

5.4 Moyenne

Publiée le 08/10/2026 à 00:17 · Modifiée le 08/10/2026 à 23:07 · En attente d'analyse NVD · Source : security@hashicorp.com

Description

Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability (CVE-2026-105820) is fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Vault Community Edition does not support namespaces, and is not affected.

Traduire en français

Produits concernés

HashiCorp Vault Enterprise

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.4 Moyenne	security@hashicorp.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-22

Références

https://discuss.hashicorp.com/t/hcsec-2026-42-vault-enterprise-acl-policy-cache-vulnerable-to-cross-namespace-policy-resolution/77814

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories