CVE-2026-14886: 
HashiCorp Vault vulnerability analysis and mitigation

CVE-2026-14886 is a cross-namespace authorization bypass vulnerability in HashiCorp Vault Enterprise's identity entity batch-delete endpoint. An authenticated caller with low privileges in one namespace can permanently delete the storage backing of identity entities belonging to other namespaces. The vulnerability was published on August 10, 2026, and affects Vault Enterprise versions 2.0.0–2.0.3, as well as earlier release lines prior to 1.21.9, 1.20.14, and 1.19.20. It carries a CVSS v3.1 base score of 8.2 (High) (GitHub Advisory, HashiCorp Forum).

The root cause is classified as CWE-862 (Missing Authorization): the identity entity batch-delete API endpoint fails to enforce namespace boundary checks, allowing requests from one namespace to reference and delete entity storage objects belonging to a different namespace. An authenticated network attacker with low privileges submits batch-delete requests targeting entity IDs outside their authorized namespace, and the endpoint processes the deletions without validating namespace ownership. Exploitation requires high attack complexity, suggesting that crafting valid cross-namespace entity references may involve non-trivial enumeration or knowledge of target entity IDs (GitHub Advisory, HashiCorp Forum).

Successful exploitation results in permanent, irreversible deletion of identity entity storage in targeted namespaces, causing both data loss (integrity impact) and denial of service for affected namespaces (availability impact). There is no confidentiality impact, as the vulnerability does not expose data — it destroys it. Because Vault Enterprise namespaces are commonly used to isolate tenants or organizational units, a compromised low-privilege account in one namespace could disrupt authentication and authorization operations across entirely separate namespaces, potentially affecting a broad set of downstream services and users (GitHub Advisory, HashiCorp Forum).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The NVD SSVC assessment confirms exploitation status as "none" and notes the attack is not automatable, reflecting the high attack complexity requirement. The EPSS score is approximately 0.239% (15th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time.

1. Reconnaissance: Obtain valid credentials or a token with low-privilege access to any namespace within a target Vault Enterprise deployment. Identify the target deployment's version to confirm it is unpatched (prior to 2.0.4, 1.21.9, 1.20.14, or 1.19.20).
2. Entity ID enumeration: Enumerate or otherwise obtain the entity IDs of identity entities belonging to a different (target) namespace. This may require prior knowledge, leaked IDs, or brute-force enumeration depending on the environment.
3. Craft batch-delete request: Construct an API request to Vault Enterprise's identity entity batch-delete endpoint (e.g., DELETE /v1/identity/entity/batch-delete) including the cross-namespace entity IDs in the request body, authenticated with the attacker's namespace token.
4. Submit request: Send the crafted request to the Vault API. Due to the missing authorization check, the endpoint processes the deletion without validating that the referenced entities belong to the caller's namespace.
5. Achieve impact: The storage backing of the targeted entities is permanently deleted, causing data loss and denial of service for the affected namespace's identity and authentication operations (HashiCorp Forum, GitHub Advisory).

• Logs: Vault audit logs showing DELETE requests to the identity entity batch-delete endpoint (/v1/identity/entity/batch-delete) originating from a token associated with one namespace but referencing entity IDs belonging to a different namespace.
• Logs: Sudden disappearance of identity entities in a namespace coinciding with batch-delete audit log entries from a different namespace's token.
• Logs: Vault operational logs recording errors or warnings related to missing entity storage for previously valid entities in affected namespaces.
• Network: Repeated or scripted API calls to the batch-delete endpoint from a single source IP or token, especially targeting multiple entity IDs in rapid succession.

HashiCorp has released patched versions of Vault Enterprise: 2.0.4, 1.21.9, 1.20.14, and 1.19.20. Organizations should upgrade to one of these versions as the primary remediation. As a temporary workaround until patching is feasible, implement network access controls to restrict access to the Vault API (particularly the identity entity batch-delete endpoint) to trusted sources only, and monitor audit logs for suspicious cross-namespace batch-delete activity (HashiCorp Forum, GitHub Advisory).

HashiCorp disclosed the vulnerability via their security advisory forum (HCSEC-2026-27) on August 10, 2026, providing patched versions and a clear description of the issue (HashiCorp Forum). No significant independent researcher commentary or notable social media discussion has been identified at this time.