Vault Update Fixes Trailing-Slash ACL Deny Bypass
Tech GuruQuick Answer
Upgrade Vault and test both path forms in ACL policies and Enterprise Sentinel rules. Review broad grants paired with narrower deny rules.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory broad delete grants, explicit denies and exact-path Sentinel endpoint policies on system configuration paths. Match edition, branch and the bulletin’s stated prerequisites before assigning exposure. Deploy the appropriate fixed Vault release through the supported upgrade procedure; validate cluster health and integrations before broad rollout. Test allowed and denied operations safely on nonproduction resources; review unexpected disable operations and retain policy and audit evidence.
Last verified: 2026-11-13 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | HashiCorp Vault Community Edition and Vault Enterprise |
|---|---|
| Advisory | HCSEC-2026-56 |
| CVE | CVE-2026-93335 |
| Authoritative release date | 2026-11-12 — November 12, 2026 at 22:28:56 UTC, from the first-party bulletin post timestamp. |
| Authority revision date | No separate revision date is provided by the authority. |
| Affected versions | Vault and Vault Enterprise through 2.2.1, subject to the specific configuration and access conditions described below. |
| Fixed version | Vault Community Edition 2.2.2; Vault Enterprise 2.2.2, 1.21.14 or 1.19.25 for the supported branch |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | HashiCorp does not confirm exploitation in the wild in this bulletin.; no exploitation claim is inferred. |
What Changed
Authenticated users with a broader permission may bypass a more specific deny by changing the trailing slash. Disabling engines, auth methods or audit devices can delete data, revoke credentials or reduce audit coverage.
What To Validate Now
- Inventory. Inventory broad delete grants, explicit denies and exact-path Sentinel endpoint policies on system configuration paths.
- Establish applicability. Match edition, branch and the bulletin’s stated prerequisites before assigning exposure.
- Remediate. Deploy the appropriate fixed Vault release through the supported upgrade procedure; validate cluster health and integrations before broad rollout.
- Validate. Test allowed and denied operations safely on nonproduction resources; review unexpected disable operations and retain policy and audit evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Disabling an auth method or audit device also requires sudo. The patch makes exact-path policies apply to both slash forms; review policies that intentionally distinguish them.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
