Vulnerability · Published Oct 7, 2026 · Assigned by HashiCorp
CVE-2026-105820Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution
Medium 5.4
In plain English
A medium-severity path traversal in Vault Enterprise from HashiCorp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Official description
Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability (CVE-2026-105820) is fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Vault Community Edition does not support namespaces, and is not affected.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HashiCorp | Vault Enterprise | 0.0.1 – before 2.1.2 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N