CVE-2026-89322: 
HashiCorp Vault vulnerability analysis and mitigation

CVE-2026-89322 is an authorization bypass vulnerability in HashiCorp Vault and Vault Enterprise caused by inconsistent evaluation of ACL policies against the canonical form of resource and policy names. An authenticated user with delegated permissions may exploit this flaw to bypass explicit deny restrictions, access protected resources, or assign denied policies — potentially leading to privilege escalation. It affects Vault Community Edition and Vault Enterprise from version 0.0.1 up to (but not including) 2.1.2, with Enterprise-specific fixes also available in versions 1.21.12, 1.20.17, and 1.19.23. The vulnerability carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory, HashiCorp Advisory).

The root cause is classified as CWE-178 (Improper Handling of Case Sensitivity): Vault's ACL policy engine did not consistently normalize resource and policy names to their canonical form before evaluation, meaning a non-canonical (e.g., differently-cased or formatted) name could bypass an explicit deny rule that was defined against the canonical form. An authenticated attacker with delegated administrative permissions can craft requests using non-canonical resource or policy name representations to circumvent deny-based ACL restrictions. No public proof-of-concept code has been identified at this time (GitHub Advisory, HashiCorp Advisory).

Successful exploitation allows an authenticated user with delegated permissions to bypass explicit ACL deny restrictions, gaining unauthorized access to protected secrets or resources within Vault, or assigning policies that should be denied to them. This results in high confidentiality, integrity, and availability impact — an attacker could read sensitive secrets, modify policies, or disrupt Vault operations. In environments where Vault manages credentials for downstream infrastructure, this could facilitate lateral movement across systems relying on Vault-issued secrets (GitHub Advisory, HashiCorp Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept at this time. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the requirement for an authenticated user with pre-existing delegated permissions. The EPSS score is approximately 0.295% (21st percentile), indicating a low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, HashiCorp Advisory).

HashiCorp has released patched versions addressing this vulnerability. Users should upgrade to the following fixed releases as soon as possible:

• Vault Community Edition: 2.1.2
• Vault Enterprise: 2.1.2, 1.21.12, 1.20.17, or 1.19.23

As interim measures, administrators should review and restrict delegated permissions to only the minimum necessary roles, audit ACL policy configurations to ensure deny restrictions are correctly defined using canonical resource and policy names, and monitor Vault audit logs for unauthorized access attempts to protected resources or unexpected policy assignments (HashiCorp Advisory, GitHub Advisory).

HashiCorp disclosed the vulnerability via their official security advisory forum (HCSEC-2026-43), providing patched versions for all supported release lines. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability aggregator coverage (HashiCorp Advisory).