{"id":"CVE-2026-105820","aliases":["BIT-vault-2026-105820","EUVD-2026-94647","GHSA-4rj6-p7m7-65jf"],"status":"published","title":"Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution","description":"Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability (CVE-2026-105820) is fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Vault Community Edition does not support namespaces, and is not affected.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00249,"percentile":0.16412,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-10-07T21:48:08Z","modified":"2026-10-16T09:45:23Z","fixes":[{"ecosystem":"Bitnami","package":"vault","fixed_in":["1.19.23","1.20.17","1.21.12","2.1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"vault","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.1"},{"fixed":"1.19.23"},{"introduced":"1.20.0"},{"fixed":"1.20.17"},{"introduced":"1.21.0"},{"fixed":"1.21.12"},{"introduced":"2.0.0"},{"fixed":"2.1.2"}]}]}],"products":[{"vendor":"hashicorp","product":"vault enterprise"}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-42-vault-enterprise-acl-policy-cache-vulnerable-to-cross-namespace-policy-resolution/77814","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105820","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4rj6-p7m7-65jf"}],"sources":{"cve":[{"id":"CVE-2026-105820","title":"Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution","description":"Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability (CVE-2026-105820) is fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Vault Community Edition does not support namespaces, and is not affected.","status":"published","published":"2026-10-07T21:48:08.017Z","modified":"2026-10-08T17:06:15.663Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:19:56.755658Z"}],"euvd":[{"id":"EUVD-2026-94647","description":"Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability (CVE-2026-105820) is fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Vault Community Edition does not support namespaces, and is not affected.","status":"published","published":"2026-10-07T21:48:08Z","modified":"2026-10-08T17:06:15Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:28.108203Z"}],"ghsa":[{"id":"GHSA-4rj6-p7m7-65jf","title":"Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal...","description":"Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability (CVE-2026-105820) is fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Vault Community Edition does not support namespaces, and is not affected.","status":"published","published":"2026-10-08T00:30:59Z","modified":"2026-10-08T00:31:10Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:12:55.932488Z"}],"nvd":[{"id":"CVE-2026-105820","description":"Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability (CVE-2026-105820) is fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Vault Community Edition does not support namespaces, and is not affected.","status":"published","published":"2026-10-07T22:17:02.99Z","modified":"2026-10-08T21:07:57.46Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:55.142936Z"}],"osv":[{"id":"BIT-vault-2026-105820","title":"Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution","description":"Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability (CVE-2026-105820) is fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Vault Community Edition does not support namespaces, and is not affected.","status":"published","published":"2026-10-16T08:47:46.214Z","modified":"2026-10-16T09:45:23.803715183Z","updated_at":"2026-11-02T15:28:36.104787Z"}]}}