CVE-2026-89322: CWE-178: Improper Handling of Case Sensitivity in HashiCorp Vault
Description
CVE-2026-89322 is a vulnerability in HashiCorp Vault and Vault Enterprise where ACL policies were not consistently evaluated against the canonical form of resource and policy names. This inconsistency could allow an authenticated user with delegated permissions to bypass explicit deny restrictions, potentially accessing protected resources or assigning denied policies, leading to privilege escalation. The issue is fixed in Vault Community Edition 2.1.2 and Vault Enterprise versions 2.1.2, 1.21.12, 1.20.17, and 1.19.23.
CVSS v3.1
Score 7.2high
Affected software
HashiCorp
Vault
HashiCorp
Vault Enterprise
pkg:github/Vault EnterpriseRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
HashiCorp Vault and Vault Enterprise versions prior to 2.1.2 (Community Edition) and prior to 1.21.12 (Enterprise) did not consistently normalize resource and policy names when evaluating ACL policies. This improper handling of case sensitivity (CWE-178) allowed authenticated users with delegated permissions to bypass explicit deny rules, potentially granting unauthorized access or privilege escalation. The vulnerability has a CVSS 3.1 score of 7.2, indicating high severity. Official patches are available in the specified fixed versions.
Potential Impact
An authenticated user with delegated permissions could bypass explicit deny restrictions in ACL policies due to inconsistent case sensitivity handling. This may lead to unauthorized access to protected resources or the assignment of denied policies, resulting in privilege escalation within the Vault environment.
Mitigation Recommendations
Apply the official patches provided by HashiCorp by upgrading to Vault Community Edition 2.1.2 or later, or Vault Enterprise versions 2.1.2, 1.21.12, 1.20.17, or 1.19.23. These versions contain the fix for the case sensitivity evaluation issue in ACL policies.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- HashiCorp
- Date Reserved
- 2026-09-11T14:10:52.452Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac6c8d92cdf04f65685a5a6
Added to database: 10/07/2026, 22:34:01 UTC
Last enriched: 10/07/2026, 22:48:16 UTC
Last updated: 10/07/2026, 22:48:16 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.