HCSEC-2026-26 - Vault vulnerable to LIST authorization bypass via trailing-slash strip

Bulletin ID: HCSEC-2026-26 Affected Products / Versions: Vault and Vault Enterprise up to 2.0.2; fixed in Vault 2.0.3 and Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19 Publication Date: August 10, 2026 Summary Vault’s ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was intended to be denied access to. This vulnerability (CVE-2026-12624) is fixed in Vault Community Edition 2.0.3 and Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19. Background Vault ACL policies grant and deny capabilities on paths, and policies commonly combine a broad allow rule on a parent path with a narrower wildcard deny rule intended to carve out a protected subpath. Vault evaluates these rules, including precedence between allow and deny, each time it authorizes a request. Details When a LIST request was made against a denied path expressed with a trailing slash, the policy engine normalized the request path before performing its prefix lookup, causing it to match the broader allow rule instead of the more specific wildcard deny rule. As a result, a token could receive a LIST response enumerating entry names beneath a path it was intended to be denied. This issue requires an authenticated token that has already been granted a broad allow capability on a parent path together with a narrower wildcard deny rule; tokens without this specific policy combination are not affected. The issue was limited to disclosure of entry names via LIST; it did not disclose secret values and did not grant any capability beyond listing. Remediation Customers should evaluate the risk associated with this issue and upgrade to Vault 2.0.3 or Vault Enterprise 2.0.3, 1.21.8, 1.20.13, or 1.19.19. Acknowledgement This issue was reported to HashiCorp by Mike Cole of Redpath …