HashiCorp Vault Fixes Case-Variant ACL Deny Bypass
Tech GuruQuick Answer
Update affected Vault deployments and review explicit deny policies. The fix changes case matching beyond auth methods; Enterprise delegation tokens require separate policy restrictions.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Vault edition and version, LDAP/RADIUS configuration, SCIM clients, delegated identity-management permissions and protected paths. Match the advisory conditions to deployed configuration and authorization policy before assigning exposure. Apply the exact edition-specific fixed release listed above through the supported upgrade or dependency-management process. Test denied case variants and permitted management operations after updating. Review audit events for changes to protected identities and retain policy snapshots and test results.
Last verified: 2026-11-14 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | HashiCorp Vault Community Edition and Vault Enterprise |
|---|---|
| Advisory | HCSEC-2026-58 |
| CVE | CVE-2026-128100 |
| Authoritative release date | 2026-11-13T20:08:59.172Z — vendor advisory publication timestamp; no later revision is recorded. |
| Authority revision date | No separate material revision date is provided by the authority. |
| Affected versions | Vault Community Edition and Vault Enterprise through 2.2.1, where broader write permissions are combined with explicit deny rules for case-insensitive LDAP/RADIUS identities or Enterprise SCIM clients. LDAP with case_sensitive_names enabled is excluded; RADIUS requires case_insensitive_names enabled. |
| Fixed version | Vault Community Edition 2.2.2; Vault Enterprise 2.2.2, 1.21.14 or 1.19.25. |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | The HashiCorp advisory does not confirm exploitation in the wild.; no exploitation claim is inferred. |
What Changed
HashiCorp fixes an authorization mismatch between ACL request paths and case-insensitive identity names. An authenticated delegated user could modify a protected identity by varying its letter case.
What To Validate Now
- Inventory. Inventory Vault edition and version, LDAP/RADIUS configuration, SCIM clients, delegated identity-management permissions and protected paths.
- Establish applicability. Match the advisory conditions to deployed configuration and authorization policy before assigning exposure.
- Remediate. Apply the exact edition-specific fixed release listed above through the supported upgrade or dependency-management process.
- Validate. Test denied case variants and permitted management operations after updating. Review audit events for changes to protected identities and retain policy snapshots and test results.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Review deny rules that intentionally distinguish case, including case-sensitive secrets engines. Use explicit deny paths without a trailing slash for case-insensitive identities. Delegation tokens are outside this fix; avoid broad allow rules combined with narrow deny rules for those tokens.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
