What is the CVSS score of CVE-2026-3605?

CVE-2026-3605 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Vault are affected by CVE-2026-3605?

HashiCorp Vault KVv2 authentication bypass allows low-privilege users to permanently delete secrets outside their authorized scope, creating a denial-of-service risk for organizations storing…. A patch is available.

How to fix or mitigate CVE-2026-3605?

Within 24 hours: Inventory all HashiCorp Vault instances and confirm KVv2 secret engine usage and glob-based policy configurations. Within 7 days: Apply vendor-released patch to all affected Vault versions (0.10.0 through latest 1.x prior to patched release-consult HashiCorp advisory for exact patched version numbers). Within 30 days: Audit secret deletion logs for unauthorized deletions and validate glob policy restrictions are functioning post-patch.

Vault CVE-2026-3605

EUVD-2026-23346 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-04-17 HashiCorp

GHSA-m2w4-8ggf-rj47

Information Disclosure Hashicorp Vault Vault Enterprise

8.1

CVSS 3.1 · Vendor: HashiCorp

Severity by source

Vendor (HashiCorp) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (HashiCorp).

CVSS VectorVendor: HashiCorp

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 25, 2026 - 18:08 nvd

Patch available

Analysis Updated

Apr 17, 2026 - 04:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 17, 2026 - 04:22 vuln.today

cvss_changed

Patch available

Apr 17, 2026 - 04:01 EUVD

Analysis Generated

Apr 17, 2026 - 03:34 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 03:30 euvd

EUVD-2026-23346

Analysis Generated

Apr 17, 2026 - 03:30 vuln.today

CVE Published

Apr 17, 2026 - 02:44 nvd

HIGH 8.1

DescriptionCVE.org

An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

AnalysisAI

HashiCorp Vault's KVv2 secrets engine allows authenticated users with glob-based policy access to delete secrets outside their authorization scope, causing denial-of-service across versions 0.10.0 through 1.x. The flaw stems from improper access control (CWE-288) in policy glob evaluation during delete operations. Exploitation requires valid Vault credentials with specific policy patterns but does not permit cross-namespace deletion or secret data exfiltration. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0/1.21.5/1.20.10/1.19.16. No active exploitation confirmed (EPSS 0.01%), but CVSS 8.1 reflects high integrity and availability impact for authenticated attackers.

Technical ContextAI

HashiCorp Vault's Key-Value version 2 (KVv2) secrets engine implements path-based access control using HashiCorp Configuration Language (HCL) policies. Policies support glob patterns (wildcards like '*' or '+') to match multiple paths without enumerating each explicitly. CWE-288 (Authentication Bypass Using an Alternate Path or Channel) manifests when the delete operation evaluates glob patterns incorrectly, granting delete permissions beyond the intended read/write scope. The vulnerability affects both open-source Vault (cpe:2.3:a:hashicorp:vault) and Enterprise editions (cpe:2.3:a:hashicorp:vault_enterprise) from version 0.10.0 (initial KVv2 release circa 2018) through all 1.x branches. The flaw resides in the policy evaluation logic during metadata and secret deletion API calls, not in cryptographic operations or authentication mechanisms. Namespace isolation remained intact, preventing horizontal privilege escalation across tenant boundaries in Vault Enterprise deployments.

RemediationAI

Upgrade to patched versions immediately: Vault Community Edition 2.0.0 or Vault Enterprise 2.0.0 (all editions), 1.21.5 (for 1.21.x users), 1.20.10 (for 1.20.x users), or 1.19.16 (for 1.19.x long-term support users). Download links and upgrade instructions available in HashiCorp advisory HCSEC-2026-05 at https://discuss.hashicorp.com/t/hcsec-2026-05-vault-kvv2-metadata-and-secret-deletion-policy-bypass-denial-of-service/77342. For environments unable to upgrade immediately, implement compensating controls: audit all KVv2 policies for glob usage (search for '*' or '+' in path statements), replace glob patterns with explicit path lists where feasible (increases policy verbosity but eliminates attack surface), enable Vault audit logging to detect anomalous delete operations (log analysis overhead required), and restrict policy assignment to minimize users with glob-based KVv2 access (operational impact on teams relying on wildcard convenience). Note that removing glob patterns may require policy refactoring for complex path hierarchies, and audit log volume will increase proportionally to secret operation frequency. No workaround fully mitigates risk without patching.