This vulnerability (CVE-2026-3605) involves an authentication bypass using an alternate path or channel (CWE-288) in HashiCorp Vault. Specifically, an authenticated user with a policy granting access to a kvv2 path through a glob pattern can delete secrets beyond their intended permissions, resulting in denial-of-service. The vulnerability does not permit unauthorized reading of secret data or deletion of secrets across namespaces. The issue is addressed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16. The CVSS v3.1 score is 8.1 (High), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and high availability impact. No known exploits are reported in the wild. The vendor advisory from Red Hat confirms the fix availability.

An attacker who is authenticated and has access to a kvv2 path via a glob-based policy can delete secrets they are not authorized to manage, causing denial-of-service. There is no impact on confidentiality as secrets cannot be read without authorization, and secrets in other namespaces cannot be deleted. The integrity and availability of affected secrets are compromised within the scope of the user's namespace and policy.

This vulnerability is fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16. Users should upgrade to one of these fixed versions to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.