CVE-2026-105820 Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution
Attackers can use path traversal in policy names to access capabilities from other namespaces, including root, in Vault Enterprise.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-105820?
CVE-2026-105820 is a medium-severity path traversal vulnerability in HashiCorp Vault Enterprise, published on 7 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability (CVE-2026-105820) is fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Vault Community Edition does not support namespaces, and is not affected.
Weakness: CWE-22
Which versions are affected by CVE-2026-105820?
1 open source package ship an affected version, including vault.
| Package | Affected | Fixed in |
|---|---|---|
vault Bitnami | From 0.0.1 | 1.19.23, 1.20.17, 1.21.12, 2.1.2 |
How do I fix CVE-2026-105820?
Upgrade vault to a fixed version for your release line: 1.19.23, 1.20.17, 1.21.12 or 2.1.2.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-105820 being exploited?
There is no known exploitation of CVE-2026-105820 in the wild and no public exploit code.
Sources
Also known as BIT-vault-2026-105820, GHSA-4rj6-p7m7-65jf, MINI-ffm2-qcfx-3vqc.