HCSEC-2026-26 - Vault vulnerable to LIST authorization bypass via trailing-slash strip

{
  "id": "a15c2db297e0da2212053bfdcea88d49ecc1861e4a80ea5999996223d906fe2b",
  "url": "https://discuss.hashicorp.com/t/hcsec-2026-26-vault-vulnerable-to-list-authorization-bypass-via-trailing-slash-strip/77632",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "HCSEC-2026-26 - Vault vulnerable to LIST authorization bypass via trailing-slash strip",
    "summary": "Vault’s ACL policy engine could allow an authenticated token with a broad allow rule and a narrower wildcard deny rule to list entry names beneath the denied path when the LIST request used a trailing slash. The issue did not disclose secret values. Upgrade to a fixed version.",
    "evidence": "When a LIST request was made against a denied path expressed with a trailing slash, the policy engine normalized the request path before performing its prefix lookup, causing it to match the broader allow rule instead of the more specific wildcard deny rule.",
    "products": [
      {
        "name": {
          "value": "Vault",
          "evidence": "Vault and Vault Enterprise up to 2.0.2"
        },
        "prerequisites": [
          {
            "value": "an authenticated token that has already been granted a broad allow capability on a parent path together with a narrower wildcard deny rule",
            "evidence": "This issue requires an authenticated token that has already been granted a broad allow capability on a parent path together with a narrower wildcard deny rule"
          }
        ],
        "fixed_versions": [
          {
            "value": "2.0.3",
            "evidence": "Vault Community Edition 2.0.3"
          },
          {
            "value": "1.21.8",
            "evidence": "Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19"
          },
          {
            "value": "1.20.13",
            "evidence": "Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19"
          },
          {
            "value": "1.19.19",
            "evidence": "Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19"
          }
        ],
        "affected_versions": [
          {
            "value": "up to 2.0.2",
            "evidence": "Vault and Vault Enterprise up to 2.0.2"
          }
        ]
      },
      {
        "name": {
          "value": "Vault Enterprise",
          "evidence": "Vault and Vault Enterprise up to 2.0.2"
        },
        "prerequisites": [
          {
            "value": "an authenticated token that has already been granted a broad allow capability on a parent path together with a narrower wildcard deny rule",
            "evidence": "This issue requires an authenticated token that has already been granted a broad allow capability on a parent path together with a narrower wildcard deny rule"
          }
        ],
        "fixed_versions": [
          {
            "value": "2.0.3",
            "evidence": "Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19"
          },
          {
            "value": "1.21.8",
            "evidence": "Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19"
          },
          {
            "value": "1.20.13",
            "evidence": "Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19"
          },
          {
            "value": "1.19.19",
            "evidence": "Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19"
          }
        ],
        "affected_versions": [
          {
            "value": "up to 2.0.2",
            "evidence": "Vault and Vault Enterprise up to 2.0.2"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [
      {
        "cve": "CVE-2026-12624",
        "product": "Vault",
        "evidence": "This vulnerability (CVE-2026-12624) is fixed in Vault Community Edition 2.0.3"
      },
      {
        "cve": "CVE-2026-12624",
        "product": "Vault Enterprise",
        "evidence": "This vulnerability (CVE-2026-12624) is fixed in Vault Community Edition 2.0.3 and Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19."
      }
    ],
    "related_cves": [
      {
        "value": "CVE-2026-12624",
        "evidence": "This vulnerability (CVE-2026-12624) is fixed in Vault Community Edition 2.0.3 and Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19."
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-hashicorp-discuss-security",
  "document_id": 24016,
  "published_at": "2026-08-10T16:56:59+00:00"
}