CVE-2026-89322

{
  "etk_id": "ETK-2026-918",
  "cve_id": "CVE-2026-89322",
  "display_id": "CVE-2026-89322",
  "ghsa_id": "GHSA-j78r-9xrv-vxf6",
  "euvd_id": "EUVD-2026-94648",
  "status": "published",
  "anchor_state": "anchored",
  "title": "ACL deny-rule bypass in Vault",
  "summary": "Vault and Vault Enterprise can apply ACL deny rules inconsistently when resource or policy names are represented differently. An authenticated user with delegated permissions may access restricted resources or assign prohibited policies, which can increase their privileges.",
  "mitigation": "Upgrade Vault Community Edition to 2.1.2. Upgrade Vault Enterprise to 2.1.2, 1.21.12, 1.20.17, or 1.19.23, as appropriate for the deployed release line.",
  "vendor": "HashiCorp",
  "product": "Vault",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.0.1, < 2.1.2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.1.2"
      ],
      "package_name": "Vault",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.0.1, < 2.1.2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.1.2"
      ],
      "package_name": "Vault Enterprise",
      "purl": null
    }
  ],
  "cwes": [
    178
  ],
  "cvss_score": 7.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.003,
  "epss_percentile": 0.2091,
  "epss_asof": "2026-10-21",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 10.518626116666667,
  "t0_at": "2026-10-07T22:01:37.893000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-08T00:43:58.168749+00:00",
      "days": 0.11273467302083333,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T22:01:37.893000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-07T22:01:37.893000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T22:01:37.893000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89322"
    }
  }
}