---
id: "CVE-2026-128100"
page: "https://infrastack.ai/live/CVE-2026-128100"
kind: "vulnerability"
aliases: ["CVE-2026-128100"]
title: "HashiCorp Vault: case-variant user names bypass ACL deny rules"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["hashicorp", "infrastructure", "self-hosted", "vault"]
not_affected_if: ["case-sensitive-auth-methods", "managed-hosting", "no-delegated-permissions"]
published_at: "2026-11-13T20:18:56+00:00"
first_seen_at: "2026-11-13T21:27:24+00:00"
updated_at: "2026-11-13T21:29:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128100", "first_seen_at": "2026-11-13T21:27:24+00:00"}]
exploit_sources: []
---

# HashiCorp Vault: case-variant user names bypass ACL deny rules

Link for people: https://infrastack.ai/live/CVE-2026-128100 (this .md is for agents)

Vault did not apply explicit ACL deny rules to letter-case variants of user and group names in auth methods that treat those names as case-insensitive. An authenticated user with delegated permissions could modify a protected user or group and possibly escalate privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running Vault version with `vault version`.
- Review whether any auth method (such as userpass or LDAP) treats user or group names as case-insensitive and has ACL deny rules on specific users or groups.

## Fix

- Vault Community Edition: upgrade to `2.2.2`.
- Vault Enterprise: upgrade to `2.2.2`, `1.21.14`, or `1.19.25` depending on the release line in use.

## Timeline

- 2026-11-13T21:27:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128100

## Documents

- [mentions] HashiCorp security: HCSEC-2026-58 - Vault vulnerable to ACL deny bypass via case-variant auth method user and group names https://discuss.hashicorp.com/t/hcsec-2026-58-vault-vulnerable-to-acl-deny-bypass-via-case-variant-auth-method-user-and-group-names/78256

## From the sources

Vault Community Edition and Vault Enterprise did not apply explicit ACL policy deny rules to letter case variants of user and group names in auth methods that treat these names as case-insensitive. This may allow an authenticated user with delegated permissions to modify a protected user or group, potentially leading to privilege escalation. This vulnerability (CVE-2026-128100) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_