v2.2.0-rc1
2026-10-09T08:52:03Z•8f52d7091a204e24cca075d4db12f8901a1eb6391f9a01fd5c4f7eb3c7723088
CVE-2026-39829ACL bypassACMEHashiCorp VaultPKISCIMSSHaccess controlcase normalizationcontainer securitydependency vulnerabilitiesidentity managementpath traversalplugin securitypolicy bypassprivilege escalationsecurity update
What happened
HashiCorp Vault releases from June through October 2026 include multiple security fixes affecting ACL enforcement, identity and SCIM isolation, plugin execution paths, path traversal handling, case-normalization bypasses, dependency vulnerabilities, SSH key sizing, and LIST authorization. Version 2.1.2 addresses several privilege-escalation and policy-bypass issues, including malformed policy references, plugin binaries outside plugin_directory, and case-variant names evading exact-deny policies. Operators should upgrade promptly and review documented residual case-insensitivity limitations. A
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- hashicorp_vault_releases
- Record identifier
- 8f52d7091a204e24cca075d4db12f8901a1eb6391f9a01fd5c4f7eb3c7723088
- Enrichment time
- 2026-10-09T08:52:03Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.