CVE-2026-89322: Vault 0.0.1 to before 2.1.2; +1 more affected products

Affected technology

Vault · 0.0.1 to before 2.1.2
HashiCorp

Vault Enterprise · 0.0.1 to before 2.1.2; status changes: 1.21.12 — unaffected, 1.20.17 — unaffected, 1.19.23 — unaffected
HashiCorp

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

An authenticated user with delegated permissions may bypass an explicit deny restriction and access a protected resource or assign a denied policy, potentially leading to privilege escalation. Vendor/CNA’s CVSS 3.1 assessment (base score 7.2/10) rates confidentiality, integrity and availability impact as high.