CVE-2026-12624 Vault vulnerable to LIST authorization bypass via trailing-slash strip
Attackers can bypass ACL deny rules to enumerate secret names via trailing slashes, exposing sensitive metadata in HashiCorp Vault deployments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-12624?
CVE-2026-12624 is a medium-severity missing authorization vulnerability in HashiCorp Vault, published on 10 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Vault’s ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was intended to be denied access to. This vulnerability (CVE-2026-12624) is fixed in Vault Community Edition 2.0.3 and Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19.
Weakness: CWE-863
Which versions are affected by CVE-2026-12624?
1 open source package ship an affected version, including vault.
| Package | Affected | Fixed in |
|---|---|---|
vault Bitnami | All versions | 2.0.3 |
How do I fix CVE-2026-12624?
Upgrade vault to 2.0.3 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-12624 being exploited?
There is no known exploitation of CVE-2026-12624 in the wild and no public exploit code.
Sources
Also known as BIT-vault-2026-12624, MINI-7ggp-cf69-qc79.