HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service

CAO 8.1CVE-2026-3605 · BIT-vault-2026-3605 · GHSA-m2w4-8ggf-rj47 · Công bố 17/04/2026 · cập nhật 26/10/2026

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/hashicorp/vault Go	`≥ 0.10.0, ≤ 1.21.4≥ 0.10.0`	Chưa có bản vá
vault hashicorp	`≥ 0.10.0, < 1.19.16≥ 0.10.0, < 2.0.0≥ 1.20.0, < 1.20.10≥ 1.21.0, < 1.21.5`	`1.19.162.0.01.20.101.21.5`

Mô tả

An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

Mô tả của NVD

An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

Tham khảo

Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.

Quét site miễn phí

Gói / sản phẩm

Phiên bản bị ảnh hưởng

Phiên bản đã vá

github.com/hashicorp/vault

≥ 0.10.0, ≤ 1.21.4≥ 0.10.0

Chưa có bản vá

vault

hashicorp

≥ 0.10.0, < 1.19.16≥ 0.10.0, < 2.0.0≥ 1.20.0, < 1.20.10≥ 1.21.0, < 1.21.5

1.19.162.0.01.20.101.21.5

Mô tả

Mô tả của NVD

An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.