CVE-2026-5006

MediumCVSS 6.8/10Last modified Oct 12, 2026

Description

A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths.

An attacker who can control the referenced identity value may include slash ({{/}}) characters that Vault interprets as additional path segments when rendering the policy.

This vulnerability, CVE-2026-5006, was fixed in Vault Community Edition 2.0.4 and Vault Enterprise 2.0.4, 1.21.9, 1.20.14, and 1.19.20.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-639

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
HashiCorpVault>= 0.11.0, < 2.0.4
HashiCorpVault Enterprise>= 0.11.0, < 2.0.4

References

Timeline

Published
Aug 24, 2026
Last modified
Oct 12, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-500607.8A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update CVE-2026-500617.8A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update CVE-2026-500627.8A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update CVE-2026-500637.8A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update CVE-2026-500647.8A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update CVE-2026-50075.3A vulnerability was identified in kazuph mcp-docs-rag up to 0.5.0. Affected is the function cloneRepository of the file src/index.ts of the CVE-2026-500769.1Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms alloCVE-2026-500777.7Invalid Memory Access via the MSI-X table in QVM could allow an attacker in the guest to execute arbitrary code in the QVM to cause memory cCVE-2026-500784.4Out-Of-Bounds Read in the MSI-X table in the QVM could allow an attacker in the guest to cause an information disclosure or a crash of the QCVE-2026-500793.3Time-of-check Time-of-use (TOCTOU) Race Condition in the virtio network virtual device could allow an attacker in the guest to manipulate thCVE-2026-500803.3Stack-based Buffer Overflow in the ACPI event handler of the QVM could allow an attacker in a guest to crash the QVM by sending a crafted ACCVE-2026-500825.3The Aqara Cloud Developer Portal (developer.aqara.com) issued a developer token to any email address supplied by the attacker. This is an in
CVE-2026-5006: Medium severity, CVSS 6.8 | Vulnix