CVE-2026-89322

HighCVSS 7.2/10Last modified Oct 9, 2026

Description

Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy, potentially leading to privilege escalation. This vulnerability (CVE-2026-89322) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-178

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 7, 2026
Last modified
Oct 9, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-893257.8An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user tCVE-2026-893273.8The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attribuCVE-2026-893283.8The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing severCVE-2026-893296.2A flaw was found in `multipathd`. A local attacker with access to the `multipathd` UNIX control socket can exploit this vulnerability by senCVE-2026-89337.8A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to cCVE-2026-893306.1The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulneraCVE-2026-893315.3The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board featurCVE-2026-893325.5Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allowCVE-2026-893336.5The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions CVE-2026-893346.5The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in CVE-2026-89346.9A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unaCVE-2026-89359.8The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted o