vault-cve-2026-5006-audit

CVE-2026-5006 toolkit HCSEC-2026-32 Two tools for working through the Vault templated-policy slash-injection vulnerability: an interactive walkthrough for explaining and scoping the issue, and an audit script that checks a live cluster and writes the findings to Markdown...

CVE-2026-115361

OpenBao versions prior to 2.6.3 are susceptible to an ACL bypass vulnerability. The root cause is that the system silently drops explicit deny rules when they are based on forbidden identity metadata templates within wildcard grants. This allows attackers who possess identity metadata containing ...

EUVD-2026-83955

OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the templated policy processing. An attacker can gain unauthorized access, escalate privileges, or issue unauthorized certificates by injecting wildcard or syntax-significant characters into identity data...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the templated policy processing. An attacker can gain unauthorized access, escalate privileges, or issue unauthorized certificates by injecting wildcard or syntax-significant characters into identity data...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the templated policy processing. An attacker can gain unauthorized access, escalate privileges, or issue unauthorized certificates by injecting wildcard or syntax-significant characters into identity data...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the templated policy processing. An attacker can gain unauthorized access, escalate privileges, or issue unauthorized certificates by injecting wildcard or syntax-significant characters into identity data...

Incorrect Authorization

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Incorrect Authorization via the templated policy processing. An attacker can gain unauthorized access, escalate privileges, or issue unauthorized certificates by injecting wildcard or...

CVE-2026-5006

A flaw was found in HashiCorp Vault. An authenticated attacker can manipulate identity values in templated policy paths by injecting slash characters. This manipulation allows Vault to misinterpret policy paths, leading to unintended access to Vault resources and potential privilege escalation...

BIT-VAULT-2026-5006 Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths

A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include...

Security Bulletin: Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths

Summary A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may...

CVE-2026-5006

A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include...

Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths

Summary A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may...

CVE-2026-5006 Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths

A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include...

CVE-2026-5006

A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include...

CVE-2026-5006 Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths

A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include...

EUVD-2026-65122

A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include...

CVE-2026-5006 Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths

A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include...

CVE-2026-5006

HashiCorp Vault and Vault Enterprise are vulnerable to privilege escalation via slash injection in templated policy paths . An authenticated attacker who can control an identity value referenced by a templated policy can embed / characters, which Vault interprets as additional path segments when ...

CVE-2026-5006: Authorization Bypass Through User-Controlled Key

A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include...