CVE-2026-128100: Vault vulnerable to ACL deny bypass via case-variant auth method user and group names
Vault Community Edition and Vault Enterprise did not apply explicit ACL policy deny rules to letter case variants of user and group names in auth methods that treat these names as case-insensitive. This may allow an authenticated user with delegated permissions to modify a protected user or group, potentially leading to privilege escalation. This vulnerability (CVE-2026-128100) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vault Community Editionto a version that resolves this vulnerability.Fixed in 2.2.2 - Upgrade
Upgrade
Vault Enterpriseto a version that resolves this vulnerability.Fixed in 2.2.2 - Upgrade
Upgrade
Vault Enterpriseto a version that resolves this vulnerability.Fixed in 1.21.14 - Upgrade
Upgrade
Vault Enterpriseto a version that resolves this vulnerability.Fixed in 1.19.25
Event History
Frequently Asked Questions
Which deployments are exposed?
Vault Community Edition and Vault Enterprise are affected when an auth method treats user or group names as case-insensitive and explicit ACL deny rules are used to protect those identities.
What access does an attacker need?
An attacker must already be authenticated and have delegated permissions that can be used against a letter-case variant of a protected user or group name. Exploitation may allow modification of the protected identity and potential privilege escalation.
Are default configurations affected?
The issue depends on the use of explicit ACL deny rules and an auth method with case-insensitive user or group names. The provided information does not establish that a default Vault configuration is affected.
Which versions contain fixes?
Fixes are available in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.