CVE-2026-3605

HIGH

Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service

Title source: cna

Description

An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

References (4)

Core 4

Core References

Vendor Advisory

https://access.redhat.com/security/cve/CVE-2026-3605

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2459105

Vendor Advisory

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3605.json

https://discuss.hashicorp.com/t/hcsec-2026-05-vault-kvv2-metadata-and-secret-deletion-policy-bypass-denial-of-service/77342

Scores

CVSS v3 8.1

EPSS 0.0038

EPSS Percentile 30.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-288 CWE-639

Status published

Products (5)

hashicorp/vault 0.10.0Go

hashicorp/vault 0.10.0 - 1.19.16

HashiCorp/Vault 0.10.0 - 2.0.0

hashicorp/vault 0.10.0 - 2.0.0

HashiCorp/Vault Enterprise 0.10.0 - 2.0.0

Published Apr 17, 2026

Tracked Since Apr 17, 2026