v2.2.1
2026-10-24T08:52:03Z•3cbfdd86d1b4530999d9ab7ed15f395f2757ce0f8a2ae835798878bbe1957fce
CVE-2026-111943ACL bypassCA trust storeGoHashiCorp VaultPKIThriftVaultcase sensitivity bypassdependency vulnerabilityetcdgRPCidentity managementpath traversalplugin securitypolicy alias collisionpolicy canonicalizationprivilege escalationroot policysecurity releasex/crypto
What happened
HashiCorp Vault releases document multiple security fixes across versions 2.0.3–2.2.1, including ACL and policy canonicalization bypasses, policy alias cache-key collisions, plugin path validation issues, identity isolation flaws, case-variant authorization bypasses, certificate trust-store hardening, and dependency updates addressing disclosed vulnerabilities. The latest release, v2.2.1, fixes a policy-name alias collision that could resolve aliases to the immutable root policy and updates Go to 1.27.3 for CVE-2026-111943.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- hashicorp_vault_releases
- Record identifier
- 3cbfdd86d1b4530999d9ab7ed15f395f2757ce0f8a2ae835798878bbe1957fce
- Enrichment time
- 2026-10-24T08:52:03Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.