CVE-2026-3605
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
An authenticated user with access to a kvv2 path through a policy containing a glob may delete secrets they were not authorized to read or write, causing denial-of-service. This vulnerability does not allow cross-namespace deletion or reading of secret data.
Risk Assessment
The risk is a potential DoS attack by deleting secrets the user should not have access to, which can disrupt applications relying on Vault.
Recommendation
Immediately upgrade Vault to Community 2.0.0 or Enterprise 2.0.0, 1.21.5, 1.20.10, 1.19.16. Review policies containing globs and restrict their usage.
Other vulnerabilities in HashiCorp Vault
See all- CVE-2026-5006Medium
HashiCorp Vault and Vault Enterprise have a vulnerability allowing an authenticated attacker to manipulate an identity value referenced by a templated policy path to gain unintended access. Slash characters can be interpreted as additional path segments. Fixed in Vault CE 2.0.4 and Enterprise 2.0.4, 1.21.9, 1.20.14, 1.19.20.
- CVE-2026-5051Medium
In HashiCorp Vault and Vault Enterprise prior to version 2.0.1, the audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used. This vulnerability is fixed in versions 2.0.1, 1.21.6, 1.20.11, and 1.19.17.
Original NVD description (English source)
An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.