CVE-2026-12624

Vault’s ACL policy engine did not consistently enforce a wildcard glob deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was...

CVE-2026-12624

Vault’s ACL policy engine did not consistently enforce a wildcard glob deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was...

PT-2026-69874

Name of the Vulnerable Software and Affected Versions Vault Community Edition versions prior to 2.0.3 Vault Enterprise versions prior to 2.0.3 Vault Enterprise versions prior to 1.21.8 Vault Enterprise versions prior to 1.20.13 Vault Enterprise versions prior to 1.19.19 Description The ACL policy...