CVE-2026-89322— Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions
Quick assessment
Affected
HashiCorp Vault
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
HashiCorp Vault 及 Vault Enterprise 在将访问控制列表（ACL）策略与资源和策略名称的规范形式进行比对时，未保持一致性评估。这可能导致拥有委托权限的已认证用户绕过显式的拒绝限制，从而访问受保护的资源或分配被拒绝的策略，进而可能引发权限提升。该漏洞（CVE-2026-89322）已在以下版本中修复：Vault 社区版 2.1.2，以及 Vault Enterprise 2.1.2、1.21.12、1.20.17 和 1.19.23。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-89322
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions
Source: CVE Program / CVE List V5
Vulnerability Description
Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy, potentially leading to privilege escalation. This vulnerability (CVE-2026-89322) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
大小写敏感处理不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HashiCorp | Vault | 0.0.1 ~ 2.1.2 | - |
|
| HashiCorp | Vault Enterprise | 0.0.1 ~ 2.1.2 | - |
|
II. Public POCs for CVE-2026-89322
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-89322
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-89322 (1)
Same Patch Batch · HashiCorp · 2026-10-07 · 4 CVEs total
| CVE-2026-105816 | 8.0 HIGH | Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft |
| CVE-2026-105818 | 5.9 MEDIUM | Vault PKI ACME Issues Certificate With Unvalidated SANs |
| CVE-2026-105820 | 5.4 MEDIUM | Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution |
IV. Related Vulnerabilities
Same product: Vault
-
CVE-2026-105816
Vault Vulnerable to Arbitrary Code Execution via Plugin Cata -
CVE-2026-105818
Vault PKI ACME Issues Certificate With Unvalidated SANs -
CVE-2026-5006
Vault Vulnerable to Privilege Escalation via Slash Injection -
CVE-2026-12624
Vault vulnerable to LIST authorization bypass via trailing-s -
CVE-2026-5051
Audit Log Plugin Directory Guard Bypass via Legacy path Opti
Same vendor: HashiCorp
-
CVE-2026-105820
Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy -
CVE-2026-105816
Vault Vulnerable to Arbitrary Code Execution via Plugin Cata -
CVE-2026-105818
Vault PKI ACME Issues Certificate With Unvalidated SANs -
CVE-2026-88922
Go-getter vulnerable to a privilege escalation issue in its -
CVE-2026-87993
Consul-template vulnerable to an information disclosure issu
Same weakness: CWE-178
-
CVE-2026-106503
Backstage: Scaffolder action input authorization bypass -
CVE-2026-106497
Backstage: Inconsistent catalog property permission evaluati -
CVE-2026-100693
Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass -
CVE-2026-100669
Grav before 2.0.25 Sensitive File Disclosure via Case-Variat -
CVE-2026-100580
OpenClaw before 2026.7.1 Remote Code Execution via cron tool
V. Comments for CVE-2026-89322
No comments yet