HashiCorp Vault Enterprise Cross-Namespace Policy Cache Vulnerability (CVE-2026-105820)

Vulnerability Overview HCSEC-2026-42 - Vault Enterprise ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution Vault’s ACL policy cache allows namespace traversal when the policy name contains path traversal constructs. This may allow tokens assigned a specially crafted policy name to utilize capabilities defined in policies from other namespaces, including the root namespace. This vulnerability (CVE-2026-105820) has been fixed. Affected Products Affected Products/Versions: Vault Enterprise up to version 2.1.1. Fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Release Date: October 7, 2026 Remediation Upgrade: Customers should assess the risk associated with this issue and consider upgrading to Vault Enterprise 2.1.2, 1.21.12, 1.20.17, or 1.19.23. Important Notes: Since namespaces are a feature of Vault Enterprise, Vault Community Edition is not affected, although these changes are included as defense-in-depth hardening. After upgrading, new policies and assignments containing or path segments will be rejected, and existing tokens and identities will ignore them, which may reduce their effective privileges. Operators should audit and rename any such policies before upgrading. Background Vault Enterprise namespaces provide isolated environments within a single Vault cluster, each with its own policies, authentication methods, and key engines. Policies attached to a token are resolved within the token's namespace, thus limiting the token's access to the namespace it is authorized for. Vault caches policies in memory to avoid reading them from storage with every request. Detailed Information Vault does not block policy names from referencing other namespaces via path traversal constructs; its in-memory policy cache can resolve policies belonging to different namespaces. Tokens assigned such a policy name may be granted capabilities by that policy within their own namespace, allowing the token to operate across namespace boundaries. Exploitation requires an authenticated user with the ability to assign arbitrary policy names, such as through token creation or authentication method roles. The referenced policy must exist in Vault's policy cache both when the token is created and when it is used. When the referenced policy is a root policy from another namespace, its capabilities are granted only within the token's own namespace. Acknowledgments This issue was identified by an external party. --- Related Topics HCSEC-2020-07 - Vault Enterprise Prefixed Mount Policies May Result In Unauthorized Namespace Access HCSEC-2026-43 - Vault Inconsistent ACL Policy Evaluation May Allow Bypass of Deny Restrictions HCSEC-2024-21 - Vault Operators in Root Namespace May Elevate Their Privileges HCSEC-2023-29 - Vault Enterprise's Sentinel RGP Policies Allowed For Cross-Namespace Denial of Service HCSEC-2026-27 - Vault Enterprise vulnerable to cross-namespace entity deletion --- Code Blocks in Page Screenshot No POC or exploitation code was included in the page screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

HashiCorp Vault Enterprise Cross-Namespace Policy Cache Vulnerability (CVE-2026-105820)

More from this source