CVE-2026-12624

4.3 Moyenne

Publiée le 10/08/2026 à 19:17 · Modifiée le 28/08/2026 à 17:47 · En attente d'analyse NVD · Source : security@hashicorp.com

Description

Vault’s ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was intended to be denied access to. This vulnerability (CVE-2026-12624) is fixed in Vault Community Edition 2.0.3 and Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19.

Traduire en français

Produits concernés

HashiCorp Vault
HashiCorp Vault Enterprise

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.3 Moyenne	security@hashicorp.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-863

Références

https://discuss.hashicorp.com/t/hcsec-2026-26-vault-vulnerable-to-list-authorization-bypass-via-trailing-slash-strip/77632

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories