CVE-2026-93335: Vault vulnerable to ACL deny bypass via trailing slash
Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engine, auth method, or audit device that a more specific deny rule was intended to protect. This vulnerability (CVE-2026-93335) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vault Community Editionto a version that resolves this vulnerability.Fixed in 2.2.2 - Upgrade
Upgrade
Vault Enterpriseto a version that resolves this vulnerability.Fixed in 2.2.2 - Upgrade
Upgrade
Vault Enterpriseto a version that resolves this vulnerability.Fixed in 1.21.14 - Upgrade
Upgrade
Vault Enterpriseto a version that resolves this vulnerability.Fixed in 1.19.25
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Deployments are exposed if an authenticated user has broader delete permission on system configuration paths while a more specific explicit deny rule is intended to protect a secrets engine, auth method, or audit device. The issue affects both Vault Community Edition and Vault Enterprise before the listed fixed releases.
What does an attacker need to exploit the bypass?
The attacker must already be authenticated and hold a broader delete permission on relevant system configuration paths. They can use a request path differing only by a trailing slash to bypass an intended more-specific ACL deny rule.
What could an attacker do if exploitation succeeds?
An attacker may be able to disable a secrets engine, authentication method, or audit device that an explicit ACL deny rule was meant to protect. The provided severity vector indicates integrity and availability impact, with no confidentiality impact.
Which releases contain the fix?
The issue is fixed in Vault Community Edition 2.2.2. It is fixed in Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.