GHSA: Critical Auth Bypass in Multi-tenant Vault via input.vault (CVE-2026-77366)

Vulnerability Overview Vulnerability Name: Cross-vault authorization bypass via input.vault lets any token access any configured vault Vulnerability ID: GHSA-84c9-qppq-2pq5 Severity: Critical (9.9 / 10) CVSS v3 base metrics: - Attack vector: Network - Attack complexity: Low - Privileges required: Low - User interaction: None - Scope: Changed - Confidentiality: High - Integrity: High - Availability: High Scope of Impact Affected Versions: < 1.3.1 Fixed Version: 1.3.1 Impact Description: The tool scheduler does not verify that the caller-provided matches the caller's bound vault ( ). Folder ACLs are a single global instance, and JWTs do not carry vault permissions. Consequently, any valid token can read, write, or delete any configured vault by passing , thereby breaking multi-tenant isolation. Remediation Fixed Version: 1.3.1 Remediation Description: This vulnerability was fixed in version 1.3.1. A central guard was added prior to scheduling. Workaround: Run a separate vault for each server process, or isolate each tenant on a separate process/credentials. POC Code or Exploit Code No specific POC code or exploit code was provided in the page. Additional Information CVE ID: CVE-2026-77366 Weaknesses: - CWE-639 - CWE-863 Contributor: suavecito585 Summary This vulnerability allows any valid token to access any configured vault by passing , resulting in the breakdown of multi-tenant isolation. It is recommended to implement the workaround before upgrading to version 1.3.1.

Goal Reached Thanks to every supporter — we hit 100%!

GHSA: Critical Auth Bypass in Multi-tenant Vault via input.vault (CVE-2026-77366)

More from this source