Vault ACL Engine ignores glob deny on LIST for trailing slash pre-2.0.3/1.21.8
CVE-2026-12624 Published on August 10, 2026
Vault vulnerable to LIST authorization bypass via trailing-slash strip
Vaults ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was intended to be denied access to. This vulnerability (CVE-2026-12624) is fixed in Vault Community Edition 2.0.3 and Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-12624 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-12624
Want to know whenever a new CVE is published for HashiCorp Vault? stack.watch will email you.
Affected Versions
HashiCorp Vault:- Before 2.0.3 is affected.
- Before 2.0.3 is affected.