{"id":"EUVD-2026-23346","enisaUuid":"fd261a23-423f-31f3-abaa-9afc8e30b4f4","description":"An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.","datePublished":"Apr 17, 2026, 2:44:42 AM","dateUpdated":"Jul 15, 2026, 1:02:36 AM","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","references":"https://discuss.hashicorp.com/t/hcsec-2026-05-vault-kvv2-metadata-and-secret-deletion-policy-bypass-denial-of-service/77342\n","aliases":"CVE-2026-3605\nGHSA-m2w4-8ggf-rj47\n","assigner":"HashiCorp","epss":0.38,"enisaIdProduct":[{"id":"cc81d2af-63a1-37a7-a49b-6704aaa0a533","product":{"name":"Vault Enterprise","vendor":{"name":"Hashicorp"}},"product_version":"0.10.0 \u003c2.0.0"},{"id":"da06a4ef-762c-3e7c-9413-5b8dd7a4dbc0","product":{"name":"Vault","vendor":{"name":"Hashicorp"}},"product_version":"0.10.0 \u003c2.0.0"}],"enisaIdVendor":[{"id":"5e42dbc9-d5a4-3988-80f4-0856a3868041","vendor":{"name":"Hashicorp"}}],"enisaIdVulnerability":[{"id":"2f065432-d6fc-3f01-9c7c-4d0c557f05f1","vulnerability":{"id":"GHSA-m2w4-8ggf-rj47","description":"HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service","datePublished":"Apr 17, 2026, 6:31:07 AM","dateUpdated":"Apr 18, 2026, 12:51:48 AM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-3605\nhttps://discuss.hashicorp.com/t/hcsec-2026-05-vault-kvv2-metadata-and-secret-deletion-policy-bypass-denial-of-service/77342\nhttps://github.com/hashicorp/vault\n","enisa_id":"EUVD-2026-23346\n","aliases":"CVE-2026-3605\nGHSA-m2w4-8ggf-rj47\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"9a501c25-c164-3ebe-8250-2854abaf430c","vulnerability":{"id":"CVE-2026-3605","description":"An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.","datePublished":"Apr 17, 2026, 2:44:42 AM","dateUpdated":"Jul 15, 2026, 1:02:36 AM","status":"PUBLISHED","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","references":"https://discuss.hashicorp.com/t/hcsec-2026-05-vault-kvv2-metadata-and-secret-deletion-policy-bypass-denial-of-service/77342\n","enisa_id":"EUVD-2026-23346\n","assigner":"HashiCorp","epss":0.38,"dataProcessed":"Oct 30, 2026, 7:16:53 AM","vulnerabilityProduct":[{"id":"4d8b600c-06cf-30bb-89b3-56e6296a699e","product":{"name":"Vault","vendor":{"name":"Hashicorp"}},"product_version":"0.10.0 \u003c2.0.0"},{"id":"5eb63066-47de-3fa7-9b1a-2b0ba1011800","product":{"name":"Vault Enterprise","vendor":{"name":"Hashicorp"}},"product_version":"0.10.0 \u003c2.0.0"}],"vulnerabilityVendor":[{"id":"54f9f94f-60ec-3c11-a6e9-c884e9f9611e","vendor":{"name":"Hashicorp"}}]}}],"enisaIdAdvisory":[{"id":"5e15b780-6b23-33ae-a98a-df392869a339","advisory":{"id":"openSUSE-SU-2026:10594-1","description":"openbao-2.5.3-1.1 on GA media","summary":"openbao-2.5.3-1.1 on GA media","datePublished":"Apr 21, 2026, 12:00:00 AM","dateUpdated":"Sep 17, 2026, 5:01:49 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10594-1.json\nhttps://www.suse.com/security/cve/CVE-2026-3605/\nhttps://www.suse.com/security/cve/CVE-2026-39388/\nhttps://www.suse.com/security/cve/CVE-2026-39396/\nhttps://www.suse.com/security/cve/CVE-2026-39946/\nhttps://www.suse.com/security/cve/CVE-2026-40264/\nhttps://www.suse.com/security/cve/CVE-2026-5807/\n","aliases":"CVE-2026-3605\nCVE-2026-39388\nCVE-2026-39396\nCVE-2026-39946\nCVE-2026-40264\nCVE-2026-5807\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"0fcf575b-4efd-3f9a-a6a1-42aa69496578","product":{"name":"openbao-0:2.5.3-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"12b5c741-beca-3e7f-a5c0-f7d46d415044","product":{"name":"openbao-agent-0:2.5.3-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"14cc5967-e772-3db5-b6c1-60f3dc0c3b87","product":{"name":"openbao-cassandra-database-plugin-0:2.5.3-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"28ad71de-cd00-3e38-bc34-09401c15dc15","product":{"name":"openbao-postgresql-database-plugin-0:2.5.3-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"2c820b1c-0215-37d9-a060-2b4fd1d113c1","product":{"name":"openbao-server-0:2.5.3-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"461b9b0a-3dba-32de-a6ee-928ac9db151a","product":{"name":"openbao-cassandra-database-plugin-0:2.5.3-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"47eb8023-5008-3d39-9fe5-0127dedc7c37","product":{"name":"openbao-influxdb-database-plugin-0:2.5.3-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"4da75bcb-8c31-347a-9dcd-62c24af7d1e8","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"52a7f16a-b7ec-34dd-8706-fecf13ec7503","product":{"name":"openbao-server-0:2.5.3-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"600077e7-28b5-39b9-b63b-2570fa23a562","product":{"name":"openbao-mysql-legacy-database-plugin-0:2.5.3-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"647a1c9a-324a-3219-8e59-342a93514640","product":{"name":"openbao-mysql-legacy-database-plugin-0:2.5.3-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"6af41246-d03b-3c0b-b0c7-b1541ab9695f","product":{"name":"openbao-cassandra-database-plugin-0:2.5.3-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"6b794d46-664e-36a0-9fe1-eabd72cd800c","product":{"name":"openbao-0:2.5.3-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"6c2b7e04-74b3-3e94-a2b2-2e309ef643c7","product":{"name":"openbao-postgresql-database-plugin-0:2.5.3-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"6ece94ab-4730-33ed-ba3f-6b021465890f","product":{"name":"openbao-influxdb-database-plugin-0:2.5.3-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"6f7677ae-ca8a-3ea1-9419-2cdec6d2adf5","product":{"name":"openbao-mysql-database-plugin-0:2.5.3-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"932a0f6b-8173-3c49-8db8-81acc8b1fbb4","product":{"name":"openbao-postgresql-database-plugin-0:2.5.3-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"93ce6f95-e16c-33dc-b413-80b6943b77a2","product":{"name":"openbao-mysql-database-plugin-0:2.5.3-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"9fbdb29f-fa34-367a-b1fd-c8775a3d3fac","product":{"name":"openbao-agent-0:2.5.3-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"9fc1597e-980d-3941-aadf-53dca52e38b8","product":{"name":"openbao-server-0:2.5.3-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"a5ad04f9-ff35-3ca6-b067-31fcbc779702","product":{"name":"openbao-0:2.5.3-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"aae549c3-6533-30c4-b849-48ac58f967ae","product":{"name":"openbao-server-0:2.5.3-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"ae367fc6-7843-3b8a-9bf9-2b0f7baabaa9","product":{"name":"openbao-mysql-legacy-database-plugin-0:2.5.3-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"b2e0fb9b-8407-3f22-87b5-c5182911a9e3","product":{"name":"openbao-agent-0:2.5.3-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"b33dc311-92ba-345c-a523-6cae3784f908","product":{"name":"openbao-mysql-database-plugin-0:2.5.3-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"b8cba72d-bca5-37d9-a18d-e31cc26d2201","product":{"name":"openbao-mysql-database-plugin-0:2.5.3-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"c24379e6-a2e3-39b0-9b41-5dbebc5db9f5","product":{"name":"openbao-agent-0:2.5.3-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"c5dd9803-f637-33b0-985d-0bc3fbb5f364","product":{"name":"openbao-cassandra-database-plugin-0:2.5.3-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"c85b10b0-40b1-33f6-b0bb-958b6f32f1fd","product":{"name":"openbao-influxdb-database-plugin-0:2.5.3-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"d38eea6d-1ff5-3022-9173-e154336dcb85","product":{"name":"openbao-mysql-legacy-database-plugin-0:2.5.3-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"d9d5cee4-6e04-3f48-aa28-2545bb07e25f","product":{"name":"openbao-0:2.5.3-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"e06ce46a-4b79-3337-bedd-fcb3cff9fab1","product":{"name":"openbao-postgresql-database-plugin-0:2.5.3-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"e0a7799f-0a36-379d-89b3-65f65e07a074","product":{"name":"openbao-influxdb-database-plugin-0:2.5.3-1.1.ppc64le","vendor":{"name":"SUSE"}}}]}}]}