CVE-2026-93335

EUVD-2026-124746

12.11.2026, 22:32

Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engine, auth method, or audit device that a more specific deny rule was intended to protect. This vulnerability (CVE-2026-93335) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
HashiCorp	CNA	6.5 MEDIUM				CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).

Vendor	Product	Version	Source
hashicorp	vault	0.2.0 ≤ 𝑥 < 2.2.2	CNA

Common Weakness Enumeration

CWE-647 - Use of Non-Canonical URL Paths for Authorization Decisions
The software defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.

References

https://discuss.hashicorp.com/t/hcsec-2026-56-vault-vulnerable-to-acl-deny-bypass-via-trailing-slash/78199