CVE-2026-89322: Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions
Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy, potentially leading to privilege escalation. This vulnerability (CVE-2026-89322) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vault Community Editionto a version that resolves this vulnerability.Fixed in 2.1.2 - Upgrade
Upgrade
Vault Enterpriseto a version that resolves this vulnerability.Fixed in 2.1.2 - Upgrade
Upgrade
Vault Enterpriseto a version that resolves this vulnerability.Fixed in 1.21.12 - Upgrade
Upgrade
Vault Enterpriseto a version that resolves this vulnerability.Fixed in 1.20.17 - Upgrade
Upgrade
Vault Enterpriseto a version that resolves this vulnerability.Fixed in 1.19.23
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Vault Community Edition and Vault Enterprise deployments are affected when ACL policies use explicit deny restrictions and authenticated users have delegated permissions that could be used to target protected resources or assign policies.
What level of access does an attacker need?
An attacker must already be authenticated and have delegated permissions. Exploitation does not require user interaction and can be performed over the network.
What is the impact of a successful bypass?
A successful attacker may bypass an explicit deny restriction to access a protected resource or assign a denied policy. This can result in privilege escalation and compromise confidentiality, integrity, and availability.
Which versions contain fixes?
The issue is fixed in Vault Community Edition 2.1.2. For Vault Enterprise, it is fixed in versions 2.1.2, 1.21.12, 1.20.17, and 1.19.23.