CVE-2026-128100 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Vault did not apply explicit ACL deny rules to letter-case variants of user and group names in auth methods that treat those names as case-insensitive. An authenticated user with delegated permissions could modify a protected user or group and possibly escalate privileges.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running self-hosted HashiCorp Vault, Community or Enterprise, that use auth methods treating user or group names as case-insensitive and rely on explicit ACL deny rules for protected identities. Users of managed or unaffected Vault versions, or deployments without delegated permissions, are less exposed.
Not affected if case-sensitive-auth-methods, managed-hosting, no-delegated-permissions
Who cares hashicorp, self-hosted, vault
vault version.2.2.2.2.2.2, 1.21.14, or 1.19.25 depending on the release line in use.Vault Community Edition and Vault Enterprise did not apply explicit ACL policy deny rules to letter case variants of user and group names in auth methods that treat these names as case-insensitive. This may allow an authenticated user with delegated permissions to modify a protected user or group, potentially leading to privilege escalation. This vulnerability (CVE-2026-128100) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.