EUVD-2026-55677Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Authenticated low-privilege token required (PR:L); impact limited to secret path name enumeration (C:L) with no integrity, availability, or scope-change consequence.
Primary rating from Vendor (hashicorp).
CVSS VectorVendor: hashicorp
Lifecycle Timeline
2DescriptionCVE.org
Vault’s ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was intended to be denied access to. This vulnerability (CVE-2026-12624) is fixed in Vault Community Edition 2.0.3 and Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19.
AnalysisAI
HashiCorp Vault's ACL policy engine inconsistently enforces wildcard (glob) deny rules against LIST requests when a trailing slash is appended to the denied path, enabling an authenticated token holder to enumerate secret entry names beneath paths it was intended to be denied access to. Affected versions span multiple Vault Enterprise release trains and Vault Community Edition prior to 2.0.3, with confirmed fixes released across all active branches. No public exploit code or active exploitation has been identified at time of analysis; the CVSS score of 4.3 (Medium) reflects the constrained impact - path enumeration only - and the authenticated access prerequisite.
Technical ContextAI
HashiCorp Vault uses a token-based ACL policy engine where policies define allow and deny rules for secret paths using glob and wildcard matching syntax. CWE-863 (Incorrect Authorization) identifies the root cause class: the authorization logic fails to consistently apply wildcard deny rule evaluation against LIST operations when the requested path terminates with a trailing slash, causing the deny rule to be skipped during path normalization and matching. The vulnerability resides in Vault's internal policy enforcement layer, which evaluates ACL tokens before granting access to the Vault HTTP API. The flaw is specific to the intersection of two policy conditions: a broader allow rule and a narrower glob-based deny rule coexisting on the same token's policy set. No CPE strings were included in the source data; affected products are identified by vendor advisory HCSEC-2026-26 as Vault Community Edition and Vault Enterprise across the 1.19.x, 1.20.x, 1.21.x, and 2.0.x release trains.
RemediationAI
Upgrade to Vault Community Edition 2.0.3 or Vault Enterprise 2.0.3, 1.21.8, 1.20.13, or 1.19.19 as documented in HashiCorp security advisory HCSEC-2026-26 at https://discuss.hashicorp.com/t/hcsec-2026-26-vault-vulnerable-to-list-authorization-bypass-via-trailing-slash-strip/77632. If immediate patching is not feasible, audit all Vault ACL policies and replace wildcard glob deny rules on sensitive paths with explicit, non-globbed deny rules that specify the exact path and its trailing-slash variant as separate entries, eliminating reliance on glob matching as the sole security boundary for those paths. As an additional compensating control, restrict which tokens are granted broad allow rules on sensitive namespaces, reducing the policy combinations that expose the bypass. Enable Vault audit logging and alert on unexpected LIST operations against restricted paths to detect potential exploitation attempts. Note that restructuring ACL policies may carry operational impact if existing automation or CI pipelines rely on glob-based policy inheritance.
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
HashiCorp Terraform’s Vault Provider (terraform-provider-vault) did not correctly configure GCE-type bound labels for Va
An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault
PhotoRange Photo Vault 1.2 appends the password to the URI for authorization, which makes it easier for remote attackers
The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute
Server-side request forgery in bank-vaults vault-secrets-webhook (<= 1.22.2) lets a low-privileged tenant with ConfigMap
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth
vault-cli is a configurable command-line interface tool (and python library) to interact with Hashicorp Vault. Rated cri
The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 is missing validation for a client-provided parameter, w
The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 generates insufficiently random numbers, which allows re
Server-side request forgery in the Ruby css_parser gem (< 3.0.0) lets a remote unauthenticated attacker force the parsin
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today