Description

Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability (CVE-2026-14886) is fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-10T20:17:26.683Z",
  "pubdate": "2026-08-10T20:17:26.683Z",
  "executiveSummary": "CVE-2026-14886 is a cross-namespace authorization bypass vulnerability affecting the Vault Enterprise identity entity batch-delete endpoint. The flaw allows an authenticated caller situated within one namespace to bypass strict boundary controls and permanently delete the underlying storage backing of identity entities belonging to entirely separate namespaces. This security defect introduces severe multi-tenant isolation risks in enterprise environments, potentially leading to unauthorized data destruction and service disruption. Exploitation requires an authenticated attacker capable of interacting with the identity entity batch-delete endpoint, leveraging improperly validated namespace boundaries during request processing. The vulnerability impacts specific enterprise versions of the product and requires prompt remediation through established vendor patches to restore namespace isolation guarantees.",
  "technicalDetails": "The vulnerability resides in the identity entity batch-delete endpoint of Vault Enterprise, which fails to correctly enforce namespace boundary checks during the execution of bulk deletion operations. The root cause stems from improper authorization validation within the affected component, allowing request contexts originating from one namespace to traverse and target storage backings in other isolated namespaces. To exploit this vulnerability, an authenticated adversary with access to the batch-delete endpoint crafts malicious requests designed to manipulate namespace routing parameters. Upon receipt, the vulnerable component processes the deletion payload without adequately verifying whether the targeted entity storage backings reside within the caller's authorized namespace scope. Consequently, the execution flow bypasses standard access control enforcement, directing the storage backend to permanently purge identity records belonging to victims in foreign namespaces. The attack requires authenticated interaction with the API endpoint, but no elevated super-user privileges within the target namespace are necessary if the authorization checks globally fail to validate tenant boundaries. The post-exploitation impact is destructive, resulting in permanent loss of identity storage data, disruption of authentication mechanisms relying on those entities, and a total compromise of multi-tenant logical segregation within the Vault Enterprise cluster."
}