CVE-2026-5006: 
HashiCorp Vault vulnerability analysis and mitigation

CVE-2026-5006 is a privilege escalation vulnerability in HashiCorp Vault and Vault Enterprise that allows an authenticated attacker to bypass intended access controls by injecting slash characters into identity values referenced by templated policy paths. Disclosed on August 24, 2026, it affects Vault Community Edition and Vault Enterprise from version 0.11.0 up to (but not including) the patched releases. The vulnerability carries a CVSS v3.1 base score of 6.8 (Medium/High) (GitHub Advisory).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key): Vault's policy engine renders templated policy paths by substituting identity values (e.g., entity names, aliases) without sanitizing slash (/) characters. When an attacker controls an identity value and embeds slash characters, Vault interprets them as additional path segments during policy rendering, effectively allowing the attacker to traverse into path namespaces they are not authorized to access. Exploitation requires the attacker to have low-level authenticated access and the ability to influence the identity value referenced in a templated policy (e.g., by controlling their own entity name or alias). No public proof-of-concept code has been identified (GitHub Advisory, HashiCorp Advisory).

A successful exploit allows a low-privileged authenticated user to read or modify Vault secrets and data at paths they are not authorized to access, resulting in high confidentiality and integrity impact with no availability impact. Depending on the secrets stored in the unauthorized paths (e.g., credentials, certificates, encryption keys), exploitation could enable lateral movement within an organization's infrastructure or exposure of highly sensitive data. The scope is limited to the affected Vault instance, but the breadth of impact depends on what secrets are accessible via the bypassed policy paths (GitHub Advisory).

There is no evidence of public proof-of-concept code or active in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, indicating a very low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authentication and the ability to control an identity value referenced in a templated policy, which raises the attack complexity (GitHub Advisory).

1. Reconnaissance: Identify a target HashiCorp Vault instance running a vulnerable version (0.11.0 through 2.0.3 for Community Edition, or equivalent Enterprise versions before 2.0.4, 1.21.9, 1.20.14, or 1.19.20) that uses templated policy paths referencing attacker-controllable identity values (e.g., entity names, aliases, or metadata).
2. Obtain low-privileged access: Authenticate to Vault with any valid low-privileged credential (token, AppRole, etc.) that is subject to a templated policy.
3. Identify templated policy: Determine which policy paths use identity templates (e.g., secret/data/{{identity.entity.name}}/*) that reference a value the attacker can control.
4. Inject slash characters: Modify the controllable identity value (e.g., entity name or alias) to include slash characters, such as setting the entity name to legitimate/../../admin or a similar path traversal string.
5. Trigger policy rendering: Make a Vault API request to a path that causes Vault to render the templated policy with the manipulated identity value, causing the policy engine to evaluate an unintended path.
6. Access unauthorized paths: If the rendered path matches a more privileged policy, read or write secrets at paths beyond the attacker's intended authorization (GitHub Advisory, HashiCorp Advisory).

• Logs: Vault audit logs showing authenticated requests to secret paths that do not match the expected pattern for the requesting entity's identity value; requests where the resolved policy path contains unexpected additional segments relative to the entity name.
• Logs: Vault audit log entries where an entity name or alias contains slash (/) characters, which is atypical for standard identity naming conventions.
• Network: Unusual API calls from low-privileged tokens accessing high-value secret paths (e.g., PKI, database credentials, cloud IAM secrets) that are outside their expected scope.
• Configuration: Entity names or aliases in Vault identity store containing slash characters — review via vault list identity/entity/name and inspect for anomalous values.

HashiCorp has released patches addressing this vulnerability. Users should upgrade to Vault Community Edition 2.0.4 or Vault Enterprise 2.0.4, 1.21.9, 1.20.14, or 1.19.20 as soon as possible. As interim mitigations, administrators should review templated policy configurations to ensure identity values used in path templates are validated or restricted, and implement additional access controls limiting which users can modify their own identity values (entity names, aliases, metadata). Auditing Vault identity stores for entity names or aliases containing slash characters is also recommended (GitHub Advisory, HashiCorp Advisory).

HashiCorp disclosed the vulnerability through their official security advisory forum (HCSEC-2026-32) on August 24, 2026, providing patched versions and remediation guidance. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability aggregator coverage at the time of disclosure (HashiCorp Advisory).