CVE-2026-105820
Description
A flaw was found in Vault. An authenticated user can achieve privilege escalation due to improper path validation within the Access Control List (ACL) policy cache. By utilizing specially crafted policy names containing path traversal constructs, an attacker can bypass tenant boundaries and resolve permissions defined in other namespaces, including the root namespace. This allows unauthorized access to administrative capabilities and sensitive resources across the deployment.
Statement
Red Hat has evaluated this vulnerability as having a Moderate security impact because exploitation requires an authenticated attacker with permissions to create or associate manipulated policy definitions, and the affected namespace functionality is exclusive to proprietary enterprise deployments rather than open-source distributions. In typical Red Hat environments, integrating products act as Vault clients or interact with standard community editions where multi-tenant namespaces are not supported. Consequently, the flaw cannot be triggered in standard default configurations without an external enterprise deployment and delegated policy management.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.4 | N/A | 5.4 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
