Description

A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include slash ({{/}}) characters that Vault interprets as additional path segments when rendering the policy. This vulnerability, CVE-2026-5006, was fixed in Vault Community Edition 2.0.4 and Vault Enterprise 2.0.4, 1.21.9, 1.20.14, and 1.19.20.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-24T21:17:46.147Z",
  "pubdate": "2026-08-24T21:17:46.147Z",
  "executiveSummary": "A path traversal and privilege escalation vulnerability, designated as CVE-2026-5006, has been identified in HashiCorp Vault and Vault Enterprise.\nThe vulnerability allows an authenticated attacker capable of controlling an identity value referenced within a templated policy path to inject slash characters.\nWhen Vault renders the policy, it incorrectly interprets these injected characters as additional path segments, granting the attacker unintended read or write access to restricted Vault paths.\nThe affected systems include HashiCorp Vault Community Edition and Vault Enterprise.\nSuccessful exploitation requires authentication and the specific capability to control or manipulate the identity value utilized by the policy template engine.\nThe primary risk implication is a compromise of authorization boundaries, enabling unauthorized access to sensitive secrets and administrative endpoints across the secret store.\nOrganizations utilizing templated policies are exposed to severe authorization bypasses until the software is updated.",
  "technicalDetails": "The vulnerability resides in the policy rendering engine of HashiCorp Vault and Vault Enterprise, specifically within the handling of templated policy paths that incorporate dynamic identity values.\nThe root cause stems from insufficient input sanitization and validation of identity metadata or parameters referenced inside policy templates prior to path evaluation.\nThe vulnerable component is the templated policy evaluation subsystem, which fails to restrict or encode path-delimiter characters such as forward slashes when rendering dynamic variables.\nAffected software versions include HashiCorp Vault Community Edition prior to 2.0.4, and Vault Enterprise versions prior to 2.0.4, 1.21.9, 1.20.14, and 1.19.20.\nExploitation requires the attacker to possess prior authentication to the Vault instance and the ability to supply or manipulate an identity value that is subsequently interpolated into a templated policy path.\nThe attack flow proceeds as follows: First, the authenticated attacker crafts or influences an identity attribute—such as entity metadata or alias names—that is referenced in a templated policy string using template syntax. Second, the attacker injects slash characters ({{/}}) directly into this controlled identity value. Third, when the attacker triggers an operation or when the policy engine evaluates permissions, Vault renders the template by substituting the malicious identity value into the policy path string. Fourth, because the rendering engine does not neutralize the injected path separators, Vault interprets the slashes as structural path boundaries rather than literal string data. Finally, the evaluated policy incorrectly grants access to hierarchical secret paths outside the attacker's intended authorization scope, leading to a complete bypass of access control lists (ACLs)."
}