HCSEC-2026-56 - Vault vulnerable to ACL deny bypass via trailing slash

Bulletin ID: HCSEC-2026-56 Affected Products / Versions: Vault and Vault Enterprise up to 2.2.1; fixed in Vault 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25. Publication Date: November 12, 2026 Summary Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engine, auth method, or audit device that a more specific deny rule was intended to protect. This vulnerability (CVE-2026-93335) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25. Background Vault ACL policies grant or deny capabilities on API paths. Operators can combine a broad rule, such as one granting delete on all secrets engine mount paths, with a more specific rule that explicitly denies access to an individual path. The more specific rule is intended to take precedence, so an explicit deny protects that path even when a broader rule would otherwise allow the operation. Details Vault matched exact-path and segment-wildcard (+) ACL rules against the request path as supplied, so a rule written for a path did not apply to the same path with a trailing slash added or removed. The system endpoints that disable secrets engines, auth methods, and audit devices treat both forms as the same resource. As a result, a request using the other form could fail to match an explicit deny rule, be authorized by a broader matching grant, and still disable the protected resource. Other operations on these paths, such as reading a secrets engine’s configuration, were similarly affected. In Vault Enterprise, Sentinel endpoint governing policies attached to exact paths were also not applied to the other form. Disabling a secrets engine removes its stored data and revokes its leases, disabling an auth method revokes the tokens issued through it, and dis…