HCSEC-2026-32 - Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths

Bulletin ID: HCSEC-2026-32 Affected Products / Versions: Vault Community Edition from 0.11.0 up to 2.0.3; fixed in 2.0.4. Vault Enterprise from 0.11.0 up to 2.0.3, 1.21.8, 1.20.13, and 1.19.19; fixed in 2.0.4, 1.21.9, 1.20.14, and 1.19.20. Publication Date: August 24, 2026 Summary A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include slash (/) characters that Vault interprets as additional path segments when rendering the policy. This vulnerability, CVE-2026-5006, was fixed in Vault Community Edition 2.0.4 and Vault Enterprise 2.0.4, 1.21.9, 1.20.14, and 1.19.20. Background Vault policies define the capabilities granted to clients for specific paths. Vault supports identity templating in policy paths, allowing policies to incorporate identity values associated with entities, aliases, and groups. Identity templates may reference values such as names, metadata, and custom metadata. Vault renders these values when constructing the policies that apply to a token. Details An attacker who can control an identity value referenced by an applicable templated policy may include / characters in that value. Vault interprets the inserted characters as path separators, potentially causing the rendered policy rule to grant capabilities on a path that the policy author did not intend. For example, path "kv/data/{{identity.entity.metadata.department}}" { capabilities = ["read"] } If the referenced department value is admin/super-secret, the policy renders as: path "kv/data/admin/super-secret" { capabilities = ["read"]` } This may allow the attacker to read the rendered path even if the policy author intended department to represent only one path segment. Remediation Customers should evaluate their exposure to this issue and consider upgr…