Originally published at HOL

CVE-2026-5006: Vault Privilege Escalation via Slash Injection in Templated Policy Paths

TL;DR: HashiCorp Vault interpolates identity values into templated policy paths. If an authenticated attacker controls one of those values, a / in it is treated as extra path segments when the policy is rendered. That can grant capabilities on a path the policy author did not intend. HashiCorp published no CVSS in HCSEC-2026-32. The HOL Guard pack also has cvssScore: null. Not in CISA KEV. Upgrade, then turn on deny_slash_in_templated_paths. The option defaults to false even after the patch.

What happened

Vault policies grant capabilities on specific paths. Identity templating lets a policy insert entity, alias, or group names, metadata, and custom metadata into those paths when the policy is rendered for a token.

On 2026-08-24 HashiCorp published HCSEC-2026-32. An authenticated attacker who can control a referenced identity value can put a slash in it. Vault treats that slash as extra path segments. The rendered policy then grants capabilities on a path the author did not intend.

HashiCorp's example:

path "kv/data/{{identity.entity.metadata.department}}" {
    capabilities = ["read"]
}

If department is admin/super-secret, the policy renders as:

path "kv/data/admin/super-secret" {
    capabilities = ["read"]
}

CVE-2026-5006 was published on the CVE List at 2026-08-24T20:32:49.396Z. HOL Guard first saw it at 2026-08-24T20:43:17.156Z. Lior Moshe, Uri Rolls, and Daniel Peters of Operating Intelligence (opint.ai) reported it.

Affected versions

• Products: HashiCorp Vault Community Edition and Vault Enterprise
• Vault Community Edition: 0.11.0 through 2.0.3; fixed in 2.0.4
• Vault Enterprise: 0.11.0 through 2.0.3, 1.21.8, 1.20.13, and 1.19.19; fixed in 2.0.4, 1.21.9, 1.20.14, and 1.19.20
• CWE: CWE-639 (Authorization Bypass Through User-Controlled Key). HOL Guard's pack lists this CWE only.
• CVSS: not in the HashiCorp bulletin or the HOL pack (cvssScore: null). No GHSA found. Not listed in CISA KEV. knownExploited is false in the HOL pack.
• Preconditions: authenticated; can control an identity value that a templated policy interpolates; such a policy is attached.

The HOL pack packages list generic HashiCorp Vault / Vault Enterprise >=0.11.0 <2.0.4 fixed in 2.0.4. Enterprise LTS lines above come from HCSEC-2026-32, not from the HOL pack.

How to fix

Confirm the running version, then upgrade the binary to a patched release:

vault version

Upgrade Vault Community Edition to 2.0.4. Upgrade Vault Enterprise to 2.0.4, or to the matching LTS line: 1.21.9, 1.20.14, or 1.19.20. Use the binaries HashiCorp published for those versions. Do not assume a package-manager pin HashiCorp did not publish.

After the upgrade, set the deny-slash option on every Vault server. The option defaults to false even after you patch:

deny_slash_in_templated_paths = true

Or set the environment variable and restart each server:

VAULT_DENY_SLASH_IN_TEMPLATED_PATHS=true

Restart every Vault server after the config change. Review existing templated policies and identity values for compatibility before enabling the option. See HashiCorp's deny_slash_in_templated_paths docs.

Technical details

Templated policy paths interpolate identity values (entity, alias, and group names, metadata, and custom metadata). Vault treats / in a rendered identity value as extra path segments. The policy then grants capabilities on a path the author did not intend.

This is authenticated. It requires a templated policy that interpolates an attacker-controlled identity value, and that policy must be attached. HashiCorp did not publish a CVSS. HOL's pack has cvssScore: null, knownExploited: false, and editorialStatus: not_started.

This article is the operator write-up: what broke, who is affected, and how to fix it. The HOL Guard evidence page is the source record for CVE-2026-5006.

References

• HCSEC-2026-32 (HashiCorp bulletin, 2026-08-24, mark.collao)
• Vault docs: deny_slash_in_templated_paths
• CVE-2026-5006 CVE List record