Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs.
Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability (CVE-2026-105820) is fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Vault Community Edition does not support namespaces, and is not affected.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- HashiCorp
- Product
- Vault / Terraform / Consul / Nomad
- CVSS
- 5.4
- Fix
- available
- Exposure class
- Developer platform
Why it ranks 13 (Routine)
- CVSS 5.4 medium
- Product class: developer platform
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.