CVE-2026-5006: CWE-639: Authorization Bypass Through User-Controlled Key in HashiCorp Vault

The vulnerability CVE-2026-5006 in HashiCorp Vault allows an authenticated attacker to bypass authorization controls by manipulating an identity value referenced by a templated policy path. Specifically, the attacker can include slash ('/') characters in the identity value, which Vault interprets as additional path segments when rendering the policy. This can lead to unintended access to Vault paths that the attacker should not have permissions for. The issue affects multiple versions of Vault prior to the fixed releases. The vulnerability is tracked as CWE-639 (Authorization Bypass Through User-Controlled Key).

An authenticated attacker with the ability to control the referenced identity value in a templated policy path can gain unauthorized access to Vault paths beyond their intended permissions. This can lead to exposure or misuse of sensitive secrets managed by Vault. The vulnerability does not affect availability but impacts confidentiality and integrity of Vault data.

This vulnerability has been fixed in Vault Community Edition 2.0.4 and Vault Enterprise versions 2.0.4, 1.21.9, 1.20.14, and 1.19.20. Users should upgrade to one of these fixed versions or later to remediate the issue. No other mitigation or workaround is indicated in the vendor advisory.