CVE-2026-12624— Vault vulnerable to LIST authorization bypass via trailing-slash strip
Possible ATT&CK Techniques 1AI
T1083 · File and Directory DiscoveryAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| HashiCorp | Vault | < 2.0.3 | affected |
| HashiCorp | Vault Enterprise | < 2.0.3 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-12624
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Vault vulnerable to LIST authorization bypass via trailing-slash strip
Source: CVE Program / CVE List V5
Vulnerability Description
Vault’s ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was intended to be denied access to. This vulnerability (CVE-2026-12624) is fixed in Vault Community Edition 2.0.3 and Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
HashiCorp Vault 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HashiCorp Vault是美国HashiCorp公司开源的一个密码与密钥管理工具。 HashiCorp Vault 2.0.3之前版本和HashiCorp Vault Enterprise 2.0.3之前版本存在授权问题漏洞，该漏洞源于ACL策略引擎未能一致地针对带有尾斜杠的LIST请求执行通配符拒绝规则，可能导致持有更广泛允许规则和更狭窄通配符拒绝规则的令牌枚举其本应被拒绝访问的路径下的条目名称。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HashiCorp | Vault | 0 ~ 2.0.3 | - | |
| HashiCorp | Vault Enterprise | 0 ~ 2.0.3 | - |
II. Public POCs for CVE-2026-12624
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12624
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-12624 (1)
Other References for CVE-2026-12624 (1)
IV. Related Vulnerabilities
Same product: Vault
- CVE-2026-5051
Audit Log Plugin Directory Guard Bypass via Legacy path Opti - CVE-2026-5807
Vault Vulnerable to Denial-of-Service via Unauthenticated Ro - CVE-2026-4525
Vault Token Leaked to Backends via Authorization: Bearer Pas - CVE-2026-5052
Vault Vulnerable to Server-Side Request Forgery in ACME Chal - CVE-2026-3605
Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial
Same vendor: HashiCorp
- CVE-2026-14886
Vault Enterprise vulnerable to cross-namespace entity deleti - CVE-2026-19113
Unauthenticated denial of service via unbounded request body - CVE-2026-15972
Unauthenticated denial of service via unbounded external gRP - CVE-2026-15970
L7 intention authorization bypass via custom public listener - CVE-2026-19017
Consul vulnerable to partial arbitrary file read via Vault C
Same weakness: CWE-863
- CVE-2026-64952
Velociraptor Hunt Deletion With Insufficient Permission Chec - CVE-2026-19550
Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read a - CVE-2026-63177
Malcolm Vulnerable to Authorization Bypass via URI Normaliza - CVE-2026-18712
Improper Authorization in MongoDB Queryable Encryption Maint - CVE-2026-18698
Improper Authorization in MongoDB Server Allows Unauthorized
V. Comments for CVE-2026-12624
No comments yet