HCSEC-2026-27 - Vault Enterprise vulnerable to cross-namespace entity deletion

{
  "id": "fd4d92811531363296e68fae2d03883420d6b447ff4418601cfd8e9963906ed2",
  "url": "https://discuss.hashicorp.com/t/hcsec-2026-27-vault-enterprise-vulnerable-to-cross-namespace-entity-deletion/77634",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "HCSEC-2026-27 - Vault Enterprise vulnerable to cross-namespace entity deletion",
    "summary": "An authorization bypass in Vault Enterprise’s identity entity batch-delete endpoint may let an authenticated caller delete entity storage belonging to another namespace. The issue is fixed in the listed Vault Enterprise releases.",
    "evidence": "Vault Enterprise’s identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace.",
    "products": [
      {
        "name": {
          "value": "Vault Enterprise",
          "evidence": "Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20"
        },
        "prerequisites": [
          {
            "value": "an authenticated caller with access to the batch-delete endpoint in some namespace; it does not require access to the namespace that owns the target entity",
            "evidence": "The issue requires an authenticated caller with access to the batch-delete endpoint in some namespace; it does not require access to the namespace that owns the target entity."
          }
        ],
        "fixed_versions": [
          {
            "value": "2.0.4, 1.21.9, 1.20.14 and 1.19.20",
            "evidence": "This vulnerability (CVE-2026-14886) is fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20."
          }
        ],
        "affected_versions": [
          {
            "value": "2.0.0, 1.21.5, 1.20.10, and 1.19.16 LTS, up to 2.0.3, 1.21.8, 1.20.13, and 1.19.19 LTS",
            "evidence": "Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16 LTS, up to 2.0.3, 1.21.8, 1.20.13, and 1.19.19 LTS"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [
      {
        "cve": "CVE-2026-14886",
        "product": "Vault Enterprise",
        "evidence": "This vulnerability (CVE-2026-14886) is fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20."
      }
    ],
    "related_cves": [
      {
        "value": "CVE-2026-14886",
        "evidence": "This vulnerability (CVE-2026-14886) is fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20."
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-hashicorp-discuss-security",
  "document_id": 24015,
  "published_at": "2026-08-10T17:08:20+00:00"
}