CVE-2026-14886 HashiCorp CVE debrief

Who should care

Administrators and users of Vault Enterprise, especially those with multi-namespace setups, should be aware of this vulnerability and take immediate action to protect their environments. Operators, security teams, and platform administrators must review affected scope and apply vendor patches or mitigations through normal change control processes.

Technical summary

The identity entity batch-delete endpoint in Vault Enterprise is vulnerable to a cross-namespace authorization bypass. An authenticated caller in one namespace may be able to permanently delete the storage backing of entities belonging to another namespace. This issue is addressed in Vault Enterprise versions 2.0.4, 1.21.9, 1.20.14, and 1.19.20. Affected deployments require urgent review and mitigation.

Defensive priority

Authenticated callers in one namespace may be able to delete entities in another, requiring urgent attention.

Recommended defensive actions

• Review and apply vendor patches (Vault Enterprise 2.0.4, 1.21.9, 1.20.14, 1.19.20) to prevent cross-namespace entity deletion.
• Restrict access to the identity entity batch-delete endpoint to minimize potential impact.
• Monitor for suspicious activity related to entity deletion in Vault Enterprise.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE-2026-14886 record indicates a high-severity vulnerability in Vault Enterprise's identity entity batch-delete endpoint, allowing cross-namespace authorization bypass. Official records show a CVSS score of 8.2. Vendor Hashicorp has provided fixes in multiple versions: 2.0.4, 1.21.9, 1.20.14, and 1.19.20. Evidence is limited; defenders should verify affected deployments, review official advisories, and monitor for suspicious activity related to entity deletion.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.