CVE-2026-5006

Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths

State: Published
Severity: 6.8 Medium
Published: Aug 24, 2026
Updated: Aug 26, 2026
Reserved: Mar 27, 2026

Description

A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths.

An attacker who can control the referenced identity value may include slash ({{/}}) characters that Vault interprets as additional path segments when rendering the policy.

This vulnerability, CVE-2026-5006, was fixed in Vault Community Edition 2.0.4 and Vault Enterprise 2.0.4, 1.21.9, 1.20.14, and 1.19.20.

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N	HashiCorp

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
VaultHashiCorp	0.11.0 to before 2.0.4Affectedfrom 2.0.4Not affected
Vault EnterpriseHashiCorp	0.11.0 to before 2.0.4Affectedfrom 1.19.20Not affectedfrom 1.20.0Affectedfrom 1.20.14Not affectedfrom 1.21.0Affectedfrom 1.21.9Not affectedfrom 2.0.0Affectedfrom 2.0.4Not affected

References

https://discuss.hashicorp.com/t/hcsec-2026-32-vault-vulnerable-to-privilege-escalation-via-slash-injection-in-templated-policy-paths

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.