HCSEC-2026-43 - Vault Inconsistent ACL Policy Evaluation May Allow Bypass of Deny Restrictions

{
  "id": "fe2b1f1591b670babc3826fa8bc46e775507fcc7c153a052ebaa6be90dd2d651",
  "url": "https://discuss.hashicorp.com/t/hcsec-2026-43-vault-inconsistent-acl-policy-evaluation-may-allow-bypass-of-deny-restrictions/77815",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "HCSEC-2026-43 - Vault Inconsistent ACL Policy Evaluation May Allow Bypass of Deny Restrictions",
    "summary": "Vault may inconsistently evaluate ACL policies, allowing an authenticated user with delegated permissions to bypass deny restrictions. The issue is fixed in the listed Vault Community Edition and Vault Enterprise versions. Upgrading may require rewriting affected policy rules in lowercase; several auth methods and SCIM clients are not covered by the fix.",
    "evidence": "Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names.",
    "products": [
      {
        "name": {
          "value": "Vault Community Edition",
          "evidence": "Vault Community Edition up to 2.1.1; fixed in Vault Community Edition 2.1.2."
        },
        "prerequisites": [
          {
            "value": "an authenticated principal holding broad delegated permissions on an affected endpoint",
            "evidence": "Exploitation requires an authenticated principal holding broad delegated permissions on an affected endpoint"
          }
        ],
        "fixed_versions": [
          {
            "value": "2.1.2",
            "evidence": "Vault Community Edition up to 2.1.1; fixed in Vault Community Edition 2.1.2."
          }
        ],
        "affected_versions": [
          {
            "value": "up to 2.1.1",
            "evidence": "Vault Community Edition up to 2.1.1; fixed in Vault Community Edition 2.1.2."
          }
        ]
      },
      {
        "name": {
          "value": "Vault Enterprise",
          "evidence": "Vault Enterprise up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
        },
        "prerequisites": [
          {
            "value": "an authenticated principal holding broad delegated permissions on an affected endpoint",
            "evidence": "Exploitation requires an authenticated principal holding broad delegated permissions on an affected endpoint"
          }
        ],
        "fixed_versions": [
          {
            "value": "2.1.2",
            "evidence": "Vault Enterprise up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
          },
          {
            "value": "1.21.12",
            "evidence": "Vault Enterprise up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
          },
          {
            "value": "1.20.17",
            "evidence": "Vault Enterprise up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
          },
          {
            "value": "1.19.23",
            "evidence": "Vault Enterprise up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
          }
        ],
        "affected_versions": [
          {
            "value": "up to 2.1.1",
            "evidence": "Vault Enterprise up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [
      {
        "cve": "CVE-2026-89322",
        "product": "Vault Community Edition",
        "evidence": "This vulnerability (CVE-2026-89322) is fixed in Vault Community Edition 2.1.2"
      },
      {
        "cve": "CVE-2026-89322",
        "product": "Vault Enterprise",
        "evidence": "This vulnerability (CVE-2026-89322) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
      }
    ],
    "related_cves": [
      {
        "value": "CVE-2026-89322",
        "evidence": "This vulnerability (CVE-2026-89322) is fixed in Vault Community Edition 2.1.2"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-hashicorp-discuss-security",
  "document_id": 23999,
  "published_at": "2026-10-07T22:00:11+00:00"
}