{"id":"CVE-2026-93335","aliases":["EUVD-2026-124746","GHSA-fr98-98p8-3mxf"],"status":"published","title":"Vault vulnerable to ACL deny bypass via trailing slash","description":"Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engine, auth method, or audit device that a more specific deny rule was intended to protect. This vulnerability (CVE-2026-93335) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-647"],"published":"2026-11-12T22:32:14.454Z","modified":"2026-11-13T00:32:04Z","products":[{"vendor":"hashicorp","product":"vault"},{"vendor":"hashicorp","product":"vault enterprise"}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-56-vault-vulnerable-to-acl-deny-bypass-via-trailing-slash/78199"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93335"},{"url":"https://github.com/advisories/GHSA-fr98-98p8-3mxf"}],"sources":{"cve":[{"id":"CVE-2026-93335","title":"Vault vulnerable to ACL deny bypass via trailing slash","description":"Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engine, auth method, or audit device that a more specific deny rule was intended to protect. This vulnerability (CVE-2026-93335) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.","status":"published","published":"2026-11-12T22:32:14.454Z","modified":"2026-11-12T22:32:14.454Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-647"],"updated_at":"2026-11-12T23:50:00.740852Z"}],"euvd":[{"id":"EUVD-2026-124746","description":"Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engine, auth method, or audit device that a more specific deny rule was intended to protect. This vulnerability (CVE-2026-93335) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.","status":"published","published":"2026-11-13T00:31:58Z","modified":"2026-11-13T00:31:58Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-13T01:36:41.572072Z"}],"ghsa":[{"id":"GHSA-fr98-98p8-3mxf","title":"Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny...","description":"Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engine, auth method, or audit device that a more specific deny rule was intended to protect. This vulnerability (CVE-2026-93335) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.","status":"published","published":"2026-11-13T00:31:58Z","modified":"2026-11-13T00:32:04Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","level":"medium"}],"cwes":["CWE-647"],"updated_at":"2026-11-13T00:44:37.510355Z"}],"nvd":[{"id":"CVE-2026-93335","description":"Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engine, auth method, or audit device that a more specific deny rule was intended to protect. This vulnerability (CVE-2026-93335) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.","status":"published","published":"2026-11-13T00:20:19.023Z","modified":"2026-11-13T00:20:19.023Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-647"],"updated_at":"2026-11-13T01:33:42.076678Z"}]}}