HCSEC-2026-42 - Vault Enterprise ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution

{
  "id": "044785824565a21ed02c457f132f233488ba27bc6f4d47a4630a4cfee1bd841f",
  "url": "https://discuss.hashicorp.com/t/hcsec-2026-42-vault-enterprise-acl-policy-cache-vulnerable-to-cross-namespace-policy-resolution/77814",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "HCSEC-2026-42 - Vault Enterprise ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution",
    "summary": "Vault Enterprise’s ACL policy cache could resolve path-traversal policy names across namespaces, potentially granting a token capabilities outside its namespace. Upgrade to a fixed version; exploitation requires an authenticated user able to assign arbitrary policy names, and the referenced policy must be cached when the token is created and used.",
    "evidence": "Vault’s ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace.",
    "products": [
      {
        "name": {
          "value": "Vault Enterprise",
          "evidence": "Vault Enterprise up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
        },
        "prerequisites": [
          {
            "value": "an authenticated user able to assign arbitrary policy names to a token",
            "evidence": "Exploitation requires an authenticated user able to assign arbitrary policy names to a token, for example through token creation or an auth method role."
          },
          {
            "value": "The referenced policy must be present in Vault’s policy cache both when the token is created and when it is used.",
            "evidence": "The referenced policy must be present in Vault’s policy cache both when the token is created and when it is used."
          }
        ],
        "fixed_versions": [
          {
            "value": "2.1.2",
            "evidence": "Vault Enterprise up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
          },
          {
            "value": "1.21.12",
            "evidence": "Vault Enterprise up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
          },
          {
            "value": "1.20.17",
            "evidence": "Vault Enterprise up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
          },
          {
            "value": "1.19.23",
            "evidence": "Vault Enterprise up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
          }
        ],
        "affected_versions": [
          {
            "value": "up to 2.1.1",
            "evidence": "Vault Enterprise up to 2.1.1; fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
          }
        ]
      },
      {
        "name": {
          "value": "Vault Community Edition",
          "evidence": "Vault Community Edition does not support namespaces, and is not affected."
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [
      {
        "cve": "CVE-2026-105820",
        "product": "Vault Enterprise",
        "evidence": "This vulnerability (CVE-2026-105820) is fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
      }
    ],
    "related_cves": [
      {
        "value": "CVE-2026-105820",
        "evidence": "This vulnerability (CVE-2026-105820) is fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23."
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-hashicorp-discuss-security",
  "document_id": 24000,
  "published_at": "2026-10-07T21:46:47+00:00"
}