PT-2026-33397 · Hashicorp+1 · Vault Enterprise+2

Published 2026-04-16 · Updated 2026-05-29 · CVE-2026-3605

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions HashiCorp Vault Community Edition versions prior to 2.0.0 HashiCorp Vault Enterprise versions prior to 1.19.16 HashiCorp Vault Enterprise versions prior to 1.20.10 HashiCorp Vault Enterprise versions prior to 2.0.0

Description An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, which can lead to a denial-of-service. This issue does not allow the deletion of secrets across namespaces or the reading of secret data.

Recommendations Update HashiCorp Vault Community Edition to version 2.0.0. Update HashiCorp Vault Enterprise to version 1.19.16, 1.20.10, or 2.0.0.

Fix

DoS

LPE

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

BDU:2026-05648

BIT-VAULT-2026-3605

CVE-2026-3605

GHSA-M2W4-8GGF-RJ47

OPENSUSE-SU-2026:10594-1

Affected Products

Red Os

Vault Community Edition

Vault Enterprise

References · 18

• https://discuss.hashicorp.com/t/hcsec-2026-05-vault-kvv2-metadata-and-secret-deletion-policy-bypass-denial-of-service/77342 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m2w4-8ggf-rj47 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3605 · Security Note
• https://osv.dev/vulnerability/BIT-vault-2026-3605 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05648 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10594-1 · Vendor Advisory
• https://github.com/hashicorp/vault · Note
• https://suse.com/security/cve/CVE-2026-3605 · Note
• https://twitter.com/VulmonFeeds/status/2045012246049271917 · Twitter Post
• https://suse.com/security/cve/CVE-2026-39396 · Note
• https://suse.com/security/cve/CVE-2026-39388 · Note
• https://twitter.com/giuseppe_1337/status/2048856033661956569 · Twitter Post
• https://suse.com/security/cve/CVE-2026-5807 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-vault-cve-2026-3605-7.3 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-vault-cve-2026-3605-8.0 · Note