CVE-2026-105820 — Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution
Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use…
Published: 2026-10-07 · CVSS: 5.4 · CVSS 3.1
Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability (CVE-2026-105820) is fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Vault Community Edition does not support namespaces, and is not affected.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7