CVE-2026-105820
Medium
Description
Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability (CVE-2026-105820) is fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Vault Community Edition does not support namespaces, and is not affected.
SeverityMedium
CVSS5.4
Exploit probability—
ProductVault Enterprise
PublishedOct 7, 2026
First seenOct 7, 2026
Weakness typeCWE-22Path traversal
How to fix
Update
- HashiCorp Vault Enterprise2.1.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| HashiCorp Vault Enterprise | 0.0.1 ≤ v < 2.1.2 | 2.1.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.