v2.2.1
2026-10-23T08:52:03Z•917e868e0496e424dfdf79546f79f72b47ab136370de2a46f73491af266575fc
ACLACMEApache ThriftGo cryptoHashiCorp VaultPKISCIMSSRFaccess-control bypasscase-sensitivitydependency vulnerabilitiesetcdgRPCidentity managementpath traversalplugin securitypolicy enforcementprivilege escalation
What happened
HashiCorp Vault release feed containing multiple security fixes across versions 2.0.3 through 2.1.2, including ACL and policy bypass prevention, plugin path validation, identity and SCIM authorization hardening, dependency vulnerability updates, SSRF-safe connectivity controls, and PKI/ACME certificate validation changes. The most significant release is v2.1.2, which addresses case-variant exact-deny ACL bypasses, malformed policy path traversal references, and plugin binaries executing outside the configured plugin directory.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- hashicorp_vault_releases
- Record identifier
- 917e868e0496e424dfdf79546f79f72b47ab136370de2a46f73491af266575fc
- Enrichment time
- 2026-10-23T08:52:03Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.