{"id":"CVE-2026-14886","aliases":["BIT-vault-2026-14886","EUVD-2026-55738","GHSA-rmq8-5gxg-mjqx"],"status":"published","title":"Vault Enterprise vulnerable to cross-namespace entity deletion","description":"Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability (CVE-2026-14886) is fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00329,"percentile":0.26414,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2026-08-10T18:57:13Z","modified":"2026-10-23T19:10:00Z","fixes":[{"ecosystem":"Bitnami","package":"vault","fixed_in":["2.0.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"vault","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.4"}]}]}],"products":[{"vendor":"hashicorp","product":"vault enterprise"}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-27-vault-enterprise-vulnerable-to-cross-namespace-entity-deletion/77634","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14886","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rmq8-5gxg-mjqx"}],"sources":{"cve":[{"id":"CVE-2026-14886","title":"Vault Enterprise vulnerable to cross-namespace entity deletion","description":"Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability (CVE-2026-14886) is fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20.","status":"published","published":"2026-08-10T18:57:13.545Z","modified":"2026-08-12T18:04:39.454Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:38:43.260938Z"}],"euvd":[{"id":"EUVD-2026-55738","description":"Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability (CVE-2026-14886) is fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20.","status":"published","published":"2026-08-10T18:57:13Z","modified":"2026-08-12T18:04:39Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:57.953172Z"}],"ghsa":[{"id":"GHSA-rmq8-5gxg-mjqx","title":"Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace...","description":"Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability (CVE-2026-14886) is fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20.","status":"published","published":"2026-08-10T21:32:04Z","modified":"2026-08-10T21:32:09Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:10:16.495213Z"}],"nvd":[{"id":"CVE-2026-14886","description":"Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability (CVE-2026-14886) is fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20.","status":"published","published":"2026-08-10T20:17:26.683Z","modified":"2026-10-23T19:10:00.167Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:36.102748Z"}],"osv":[{"id":"BIT-vault-2026-14886","title":"Vault Enterprise vulnerable to cross-namespace entity deletion","description":"Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability (CVE-2026-14886) is fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20.","status":"published","published":"2026-08-24T05:55:35.006Z","modified":"2026-08-24T08:15:16.503761721Z","updated_at":"2026-11-02T15:28:36.104787Z"}]}}