CVE-2026-89322 HashiCorp CVE debrief

Who should care

Defenders responsible for Vault and Vault Enterprise instances, especially those with delegated permissions or sensitive resource access, should assess exposure and prioritize patching.

Why it matters

CVE-2026-89322 allows an authenticated user with delegated permissions to bypass explicit deny restrictions in Vault and Vault Enterprise, potentially leading to privilege escalation. Defenders should prioritize verifying and applying patches, reviewing and updating ACL policies, and monitoring for suspicious activity.

• Verification of patch application is required to prevent potential privilege escalation.
• Review and update of ACL policies is necessary to ensure explicit deny restrictions are enforced.
• Monitoring for suspicious activity related to delegated permissions is recommended.

Technical summary

The vulnerability occurs due to inconsistent evaluation of ACL policies against the canonical form of resource and policy names in Vault and Vault Enterprise. This allows an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy, potentially leading to privilege escalation. The issue is fixed in Vault Community Edition 2.1.2 and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Defenders should prioritize verifying and applying patches, reviewing and updating ACL policies, and monitoring for suspicious activity.

Defensive priority

Defenders should prioritize verifying and applying patches for Vault and Vault Enterprise instances, especially those with delegated permissions or sensitive resource access.

Recommended defensive actions

• Verify and apply patches for Vault and Vault Enterprise instances
• Review and update ACL policies to ensure explicit deny restrictions are enforced
• Monitor for suspicious activity related to delegated permissions
• Perform thorough vulnerability assessments
• Implement additional security measures
• Conduct regular security audits
• Review and update incident response plans

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and fixed versions. However, limited information is available on potential exploitation or victim impact. The vulnerability allows an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy, potentially leading to privilege escalation. Defenders should verify patch application, review and update ACL policies, and monitor for suspicious activity related to the CVE

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.