Vault v2.0.4 security fixes

{
  "id": "e0dde9188be271fdafb79d4d4856047ff18345d07d8b7e278f33f33fcc339495",
  "url": "https://github.com/hashicorp/vault/releases/tag/v2.0.4",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Vault v2.0.4 security fixes",
    "summary": "Vault v2.0.4 fixes multiple security issues involving policy-constraint bypass, SCIM ownership guardrails, cross-namespace entity deletion, and entity update retargeting.",
    "evidence": "2.0.4 August 04, 2026 BREAKING CHANGES: containers: The following packages have been removed from UBI based container images: gnupg, openssl, procps. SECURITY: acl: Fix privilege-escalation vulnerability where a denied_parameters constraint on the policies request field could be bypassed by submitting a mixed-case policy name (e.g. \"Super-Admin\" instead of \"super-admin\"). Vault now normalizes the policies parameter to lowercase before evaluating allowed_parameters/denied_parameters constraints.",
    "products": [
      {
        "name": {
          "value": "Vault",
          "evidence": "Vault now normalizes the policies parameter to lowercase before evaluating allowed_parameters/denied_parameters constraints."
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "v2.0.4",
            "evidence": "Release notes from vault\nv2.0.4"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2025-6000",
        "evidence": "audit: Fix a regression from CVE-2025-6000 that broke enabling audit devices on Windows when a plugin directory was configured."
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "github-hashicorp-vault",
  "document_id": 21369,
  "published_at": "2026-08-04T22:02:53+00:00"
}