Riskcovery

CVE-2026-3605

Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service

State
Published
Severity
8.1 High
Published
Apr 17, 2026
Updated
Jul 15, 2026
Reserved
Mar 5, 2026

Read the record on cve.org

Description

An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

Scores

CVSSScoreVectorSource
3.18.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HHashiCorp
3.18.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:Hredhat-SADP

Weaknesses

  • CWE-288 Authentication Bypass Using an Alternate Path or Channel
  • CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

ProductVersions
VaultHashiCorp
  • 0.10.0 to before 2.0.0Affected
Vault EnterpriseHashiCorp
  • 0.10.0 to before 2.0.0Affectedfrom 1.19.16Not affectedfrom 1.20.10Not affectedfrom 1.21.5Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.