HCSEC-2026-28 - Vault Secrets Operator vulnerable to arbitrary file read via AppRole secretIDPath

{
  "id": "98f416762c3aaff084d65e80379208d5c396bf39c2f13171b6e95f138745ddfd",
  "url": "https://discuss.hashicorp.com/t/hcsec-2026-28-vault-secrets-operator-vulnerable-to-arbitrary-file-read-via-approle-secretidpath/77645",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "HCSEC-2026-28 - Vault Secrets Operator vulnerable to arbitrary file read via AppRole secretIDPath",
    "summary": "Vault Secrets Operator versions 1.3.0 up to 1.4.1 allow an authenticated tenant with specified Kubernetes permissions to read accessible files from the operator pod and send their contents to a tenant-controlled endpoint. Upgrade to 1.5.0, which removes the vulnerable field.",
    "evidence": "Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue",
    "products": [
      {
        "name": {
          "value": "Vault Secrets Operator",
          "evidence": "Vault Secrets Operator 1.3.0 up to 1.4.1; fixed in Vault Secrets Operator 1.5.0."
        },
        "prerequisites": [
          {
            "value": "an authenticated Kubernetes user holding those namespaced resource permissions",
            "evidence": "This issue requires an authenticated Kubernetes user holding those namespaced resource permissions, which correspond to the editor ClusterRoles published by the Vault Secrets Operator Helm chart for end users."
          },
          {
            "value": "using the AppRole authentication method",
            "evidence": "When using the AppRole authentication method, the operator authenticates to Vault on behalf of workloads in tenant namespaces using configuration supplied through the VaultAuth and VaultConnection custom resources."
          }
        ],
        "fixed_versions": [
          {
            "value": "1.5.0",
            "evidence": "Vault Secrets Operator 1.3.0 up to 1.4.1; fixed in Vault Secrets Operator 1.5.0."
          }
        ],
        "affected_versions": [
          {
            "value": "1.3.0 up to 1.4.1",
            "evidence": "Vault Secrets Operator 1.3.0 up to 1.4.1; fixed in Vault Secrets Operator 1.5.0."
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [
      {
        "cve": "CVE-2026-8715",
        "product": "Vault Secrets Operator",
        "evidence": "This vulnerability (CVE-2026-8715) is fixed in Vault Secrets Operator 1.5.0."
      }
    ],
    "related_cves": [
      {
        "value": "CVE-2026-8715",
        "evidence": "This vulnerability (CVE-2026-8715) is fixed in Vault Secrets Operator 1.5.0."
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-hashicorp-discuss-security",
  "document_id": 24014,
  "published_at": "2026-08-13T20:26:10+00:00"
}