CVE-2026-5006— Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths
Quick assessment
Affected
HashiCorp Vault
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
发现 HashiCorp Vault 及 Vault Enterprise（统称“Vault”）中存在一个安全漏洞。该漏洞允许已认证的攻击者操纵由模板化策略路径引用的身份值，从而获得对 Vault 路径的非预期访问权限。 如果攻击者能够控制所引用的身份值，则可在其中插入斜杠（ ）字符。Vault 在渲染策略时会将这些字符解释为额外的路径段，从而导致路径遍历或越权访问。 此漏洞的 CVE 编号为 CVE-2026-5006，已在以下版本中得到修复： Vault 社区版（Community Edition）2.0.4
Possible ATT&CK Techniques 1 AI
T1528 · Steal Application Access Token
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-5006
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths.
An attacker who can control the referenced identity value may include slash ({{/}}) characters that Vault interprets as additional path segments when rendering the policy.
This vulnerability, CVE-2026-5006, was fixed in Vault Community Edition 2.0.4 and Vault Enterprise 2.0.4, 1.21.9, 1.20.14, and 1.19.20.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HashiCorp | Vault | 0.11.0 ~ 2.0.4 | - |
|
| HashiCorp | Vault Enterprise | 0.11.0 ~ 2.0.4 | - |
|
II. Public POCs for CVE-2026-5006
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-5006
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-5006 (1)
IV. Related Vulnerabilities
Same product: Vault
-
CVE-2026-12624
Vault vulnerable to LIST authorization bypass via trailing-s -
CVE-2026-5051
Audit Log Plugin Directory Guard Bypass via Legacy path Opti -
CVE-2026-5807
Vault Vulnerable to Denial-of-Service via Unauthenticated Ro -
CVE-2026-4525
Vault Token Leaked to Backends via Authorization: Bearer Pas -
CVE-2026-5052
Vault Vulnerable to Server-Side Request Forgery in ACME Chal
Same vendor: HashiCorp
-
CVE-2026-14978
Unicode normalization mismatch in go-slug ignore pattern mat -
CVE-2026-19589
Packer vulnerable to arbitrary file write via crafted plugin -
CVE-2026-8715
Vault Secrets Operator vulnerable to arbitrary file read and -
CVE-2026-14886
Vault Enterprise vulnerable to cross-namespace entity deleti -
CVE-2026-12624
Vault vulnerable to LIST authorization bypass via trailing-s
Same weakness: CWE-639
-
CVE-2026-78581
Authorization Bypass Through User-Controlled Key in Kibana L -
CVE-2026-77998
Joomla Extension - miniorange.com - Unauthenticated Authenti -
CVE-2026-56093
Broken Access Control in extension "Apache Solr for TYPO3 - -
CVE-2026-77127
Information Disclosure in extension "Modules" (modules) -
CVE-2026-77135
Information Disclosure in extension "femanager" (femanager)
V. Comments for CVE-2026-5006
No comments yet