{"post_stream":{"posts":[{"id":148118,"username":"james.warren","avatar_template":"/user_avatar/discuss.hashicorp.com/james.warren/{size}/44042_2.png","created_at":"2026-11-12T22:28:56.945Z","cooked":"\u003cp\u003e\u003cstrong\u003eBulletin ID:\u003c/strong\u003e HCSEC-2026-56\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eAffected Products / Versions:\u003c/strong\u003e Vault and Vault Enterprise up to 2.2.1; fixed in Vault 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003ePublication Date:\u003c/strong\u003e November 12, 2026\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eSummary\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eVault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engine, auth method, or audit device that a more specific deny rule was intended to protect. This vulnerability (CVE-2026-93335) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eBackground\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eVault ACL policies grant or deny capabilities on API paths. Operators can combine a broad rule, such as one granting delete on all secrets engine mount paths, with a more specific rule that explicitly denies access to an individual path. The more specific rule is intended to take precedence, so an explicit deny protects that path even when a broader rule would otherwise allow the operation.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eDetails\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eVault matched exact-path and segment-wildcard (\u003ccode\u003e+\u003c/code\u003e) ACL rules against the request path as supplied, so a rule written for a path did not apply to the same path with a trailing slash added or removed. The system endpoints that disable secrets engines, auth methods, and audit devices treat both forms as the same resource. As a result, a request using the other form could fail to match an explicit deny rule, be authorized by a broader matching grant, and still disable the protected resource. Other operations on these paths, such as reading a secrets engine’s configuration, were similarly affected. In Vault Enterprise, Sentinel endpoint governing policies attached to exact paths were also not applied to the other form. Disabling a secrets engine removes its stored data and revokes its leases, disabling an auth method revokes the tokens issued through it, and disabling an audit device may reduce audit coverage. This issue requires an authenticated user whose policies grant delete on the broader path, and disabling auth methods and audit devices also requires the sudo capability. Deployments whose policies do not combine a broader grant with a more specific explicit deny rule on these paths are not affected.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eRemediation\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eCustomers should evaluate the risk associated with this issue and consider upgrading to Vault Community Edition 2.2.2 or Vault Enterprise 2.2.2, 1.21.14, or 1.19.25. After upgrading, an exact-path rule defined for only one form of a path, with or without a trailing slash, also applies to the other form, so operators should review policies that rely on the two forms being governed by different rules.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eAcknowledgement\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThis issue was reported to HashiCorp by Tal Vaknin and other internal and external parties.\u003c/p\u003e\n\u003cp\u003e\u003cem\u003eWe deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see \u003ca href=\"https://hashicorp.com/security\"\u003ehttps://hashicorp.com/security\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e","post_number":1,"post_type":1,"posts_count":1,"updated_at":"2026-11-12T22:28:56.945Z","reply_count":0,"reply_to_post_number":null,"quote_count":0,"incoming_link_count":18,"reads":5,"readers_count":4,"score":81.0,"yours":false,"topic_id":78199,"topic_slug":"hcsec-2026-56-vault-vulnerable-to-acl-deny-bypass-via-trailing-slash","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":1,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"link_counts":[{"url":"https://hashicorp.com/security","internal":false,"reflection":false,"clicks":0}],"read":true,"user_title":null,"bookmarked":false,"actions_summary":[],"moderator":true,"admin":false,"staff":true,"user_id":35937,"hidden":false,"trust_level":4,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false,"post_url":"/t/hcsec-2026-56-vault-vulnerable-to-acl-deny-bypass-via-trailing-slash/78199/1","reactions":[],"current_user_reaction":null,"reaction_users_count":0,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null,"can_vote":false}],"stream":[148118]},"timeline_lookup":[[1,2]],"suggested_topics":[],"tags":[{"id":75,"name":"security-vault","slug":"security-vault"}],"tags_descriptions":{},"fancy_title":"HCSEC-2026-56 - Vault vulnerable to ACL deny bypass via trailing slash","id":78199,"title":"HCSEC-2026-56 - Vault vulnerable to ACL deny bypass via trailing slash","posts_count":1,"created_at":"2026-11-12T22:28:56.877Z","views":108,"reply_count":0,"like_count":0,"last_posted_at":"2026-11-12T22:28:56.945Z","visible":true,"closed":false,"archived":false,"has_summary":false,"archetype":"regular","slug":"hcsec-2026-56-vault-vulnerable-to-acl-deny-bypass-via-trailing-slash","category_id":52,"word_count":521,"deleted_at":null,"user_id":35937,"featured_link":null,"pinned_globally":false,"pinned_at":null,"pinned_until":null,"image_url":null,"slow_mode_seconds":0,"draft":null,"draft_key":"topic_78199","draft_sequence":null,"unpinned":null,"pinned":false,"current_post_number":1,"highest_post_number":1,"deleted_by":null,"actions_summary":[{"id":4,"count":0,"hidden":false,"can_act":false},{"id":8,"count":0,"hidden":false,"can_act":false},{"id":10,"count":0,"hidden":false,"can_act":false},{"id":7,"count":0,"hidden":false,"can_act":false}],"chunk_size":20,"bookmarked":false,"topic_timer":null,"message_bus_last_id":338,"participant_count":1,"show_read_indicator":false,"thumbnails":null,"slow_mode_enabled_until":null,"board_memberships":[],"related_topics":[{"fancy_title":"HCSEC-2026-26 - Vault vulnerable to LIST authorization bypass via trailing-slash strip","id":77632,"title":"HCSEC-2026-26 - Vault vulnerable to LIST authorization bypass via trailing-slash strip","slug":"hcsec-2026-26-vault-vulnerable-to-list-authorization-bypass-via-trailing-slash-strip","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-08-10T16:56:59.948Z","last_posted_at":"2026-08-10T16:57:00.037Z","bumped":true,"bumped_at":"2026-08-10T16:57:00.037Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[{"id":75,"name":"security-vault","slug":"security-vault"}],"tags_descriptions":{},"like_count":0,"views":441,"category_id":52,"featured_link":null,"op_like_count":0,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user":{"id":35937,"username":"james.warren","avatar_template":"/user_avatar/discuss.hashicorp.com/james.warren/{size}/44042_2.png","moderator":true,"trust_level":4}}]},{"fancy_title":"HCSEC-2026-43 - Vault Inconsistent ACL Policy Evaluation May Allow Bypass of Deny Restrictions","id":77815,"title":"HCSEC-2026-43 - Vault Inconsistent ACL Policy Evaluation May Allow Bypass of Deny Restrictions","slug":"hcsec-2026-43-vault-inconsistent-acl-policy-evaluation-may-allow-bypass-of-deny-restrictions","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-10-07T22:00:11.114Z","last_posted_at":"2026-10-07T22:00:11.225Z","bumped":true,"bumped_at":"2026-10-07T22:00:11.225Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[{"id":75,"name":"security-vault","slug":"security-vault"}],"tags_descriptions":{},"like_count":0,"views":455,"category_id":52,"featured_link":null,"op_like_count":0,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user":{"id":40769,"username":"mariajosep.lopez","avatar_template":"https://avatars.discourse-cdn.com/v4/letter/m/5f8ce5/{size}.png","trust_level":4}}]},{"fancy_title":"HCSEC-2026-58 - Vault vulnerable to ACL deny bypass via case-variant auth method user and group names","id":78256,"title":"HCSEC-2026-58 - Vault vulnerable to ACL deny bypass via case-variant auth method user and group names","slug":"hcsec-2026-58-vault-vulnerable-to-acl-deny-bypass-via-case-variant-auth-method-user-and-group-names","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-11-13T20:08:59.092Z","last_posted_at":"2026-11-13T20:08:59.172Z","bumped":true,"bumped_at":"2026-11-13T20:08:59.172Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[{"id":75,"name":"security-vault","slug":"security-vault"}],"tags_descriptions":{},"like_count":0,"views":45,"category_id":52,"featured_link":null,"op_like_count":0,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user":{"id":35937,"username":"james.warren","avatar_template":"/user_avatar/discuss.hashicorp.com/james.warren/{size}/44042_2.png","moderator":true,"trust_level":4}}]},{"fancy_title":"HCSEC-2026-05 - Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service","id":77342,"title":"HCSEC-2026-05 - Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service","slug":"hcsec-2026-05-vault-kvv2-metadata-and-secret-deletion-policy-bypass-denial-of-service","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-04-17T02:39:02.904Z","last_posted_at":"2026-04-17T02:39:03.003Z","bumped":true,"bumped_at":"2026-04-17T02:39:03.003Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[{"id":75,"name":"security-vault","slug":"security-vault"}],"tags_descriptions":{},"like_count":0,"views":1125,"category_id":52,"featured_link":null,"op_like_count":0,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user":{"id":25501,"username":"mark.collao","avatar_template":"/user_avatar/discuss.hashicorp.com/mark.collao/{size}/23944_2.png","trust_level":1}}]},{"fancy_title":"HCSEC-2026-32 - Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths","id":77678,"title":"HCSEC-2026-32 - Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths","slug":"hcsec-2026-32-vault-vulnerable-to-privilege-escalation-via-slash-injection-in-templated-policy-paths","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-08-24T20:40:55.060Z","last_posted_at":"2026-08-24T20:40:55.159Z","bumped":true,"bumped_at":"2026-08-24T20:40:55.159Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[{"id":75,"name":"security-vault","slug":"security-vault"}],"tags_descriptions":{},"like_count":0,"views":786,"category_id":52,"featured_link":null,"op_like_count":0,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user":{"id":25501,"username":"mark.collao","avatar_template":"/user_avatar/discuss.hashicorp.com/mark.collao/{size}/23944_2.png","trust_level":1}}]}],"summarizable":false,"has_cached_summary":false,"valid_reactions":["heart","+1","laughing","open_mouth","clap","confetti_ball","hugs"],"has_accepted_answer":false,"can_create_shared_issue":false,"shared_issue_visible":false,"can_vote":false,"vote_count":0,"user_voted":false,"details":{"can_edit":false,"notification_level":1,"participants":[{"id":35937,"username":"james.warren","avatar_template":"/user_avatar/discuss.hashicorp.com/james.warren/{size}/44042_2.png","post_count":1,"primary_group_name":null,"flair_name":null,"flair_url":null,"flair_color":null,"flair_bg_color":null,"flair_group_id":null,"moderator":true,"trust_level":4}],"created_by":{"id":35937,"username":"james.warren","avatar_template":"/user_avatar/discuss.hashicorp.com/james.warren/{size}/44042_2.png"},"last_poster":{"id":35937,"username":"james.warren","avatar_template":"/user_avatar/discuss.hashicorp.com/james.warren/{size}/44042_2.png"}},"bookmarks":[]}