CVE-2026-14886
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability is fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20.
Risk Assessment
An authenticated user can permanently delete identity entities in other namespaces, potentially leading to data loss and integrity compromise.
Recommendation
Update Vault Enterprise to one of the fixed versions: 2.0.4, 1.21.9, 1.20.14, or 1.19.20.
Original NVD description (English source)
Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability (CVE-2026-14886) is fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20.