Arbitrary file read via AppRole secretIDPath in Vault Secrets Operator (CVE-2026-8715)

Vault Secrets Operator 1.3.0 through 1.4.1 contains a flaw in the AppRole authentication configuration where the `spec.appRole.secretIDPath` field on VaultAuth and VaultAuthGlobal custom resources lacks sufficient path restrictions, allowing any accessible file on the operator pod's filesystem to be referenced. A tenant holding Kubernetes RBAC create and get permissions on VaultAuth, VaultConnection, and VaultStaticSecret resources in their namespace can direct the operator to read arbitrary files from the operator pod and transmit their contents to a tenant-controlled endpoint, potentially enabling privilege escalation within the cluster. Affected versions: - Vault Secrets Operator 1.3.0 up to 1.4.1 We recommend updating to: Vault Secrets Operator 1.5.0. CVSS 9.6 · our assessment: act_now Reference: https://discuss.hashicorp.com/t/hcsec-2026-28-vault-secrets-operator-vulnerable-to-arbitrary-file-read-via-approle-secretidpath/77645 Details: https://vuln.today/cve/CVE-2026-8715