HCSEC-2026-32 - Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths

Security
1

Bulletin ID: HCSEC-2026-32
Affected Products / Versions:
Vault Community Edition from 0.11.0 up to 2.0.3; fixed in 2.0.4.

Vault Enterprise from 0.11.0 up to 2.0.3, 1.21.8, 1.20.13, and 1.19.19; fixed in 2.0.4, 1.21.9, 1.20.14, and 1.19.20.
Publication Date: August 24, 2026

Summary
A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths.

An attacker who can control the referenced identity value may include slash (/) characters that Vault interprets as additional path segments when rendering the policy.

This vulnerability, CVE-2026-5006, was fixed in Vault Community Edition 2.0.4 and Vault Enterprise 2.0.4, 1.21.9, 1.20.14, and 1.19.20.

Background
Vault policies define the capabilities granted to clients for specific paths. Vault supports identity templating in policy paths, allowing policies to incorporate identity values associated with entities, aliases, and groups.

Identity templates may reference values such as names, metadata, and custom metadata. Vault renders these values when constructing the policies that apply to a token.

Details
An attacker who can control an identity value referenced by an applicable templated policy may include / characters in that value. Vault interprets the inserted characters as path separators, potentially causing the rendered policy rule to grant capabilities on a path that the policy author did not intend. For example,

path "kv/data/{{identity.entity.metadata.department}}" {
    capabilities = ["read"]
}

If the referenced department value is admin/super-secret, the policy renders as:

path "kv/data/admin/super-secret" {
    capabilities = ["read"]`
}

This may allow the attacker to read the rendered path even if the policy author intended department to represent only one path segment.

Remediation

Customers should evaluate their exposure to this issue and consider upgrading to Vault Community Edition 2.0.4 or Vault Enterprise 2.0.4, 1.21.9, 1.20.14, or 1.19.20.

After upgrading, operators should set deny_slash_in_templated_paths to true in the Vault server configuration on every Vault server:

deny_slash_in_templated_paths = true

Alternatively, operators may set the corresponding environment variable:

VAULT_DENY_SLASH_IN_TEMPLATED_PATHS=true

Each Vault server must be restarted after applying the configuration.

The deny_slash_in_templated_paths option defaults to false. When enabled, Vault prevents a policy rule from granting capabilities if an identity template in its path renders a value containing /.

Operators should review existing templated policies and identity values for compatibility before enabling the option. Refer to the Vault production hardening guidance for additional recommendations.

Acknowledgement
This issue was reported to HashiCorp by Lior Moshe, Uri Rolls, and Daniel Peters of Operating Intelligence (opint.ai)

We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see https://hashicorp.com/security.

1 Like