CVE-2026-12624: Vault ACL Policy Information Disclosure

CVE-2026-12624 Overview

CVE-2026-12624 is an authorization bypass vulnerability in HashiCorp Vault's Access Control List (ACL) policy engine. The engine did not consistently enforce wildcard (glob) deny rules against LIST requests that included a trailing slash on the denied path. A token that holds a broader allow rule alongside a narrower wildcard deny rule can enumerate the names of entries beneath a path it should not access. The flaw is categorized under CWE-863: Incorrect Authorization and is fixed in Vault Community Edition 2.0.3 and Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19.

Critical Impact
Authenticated Vault tokens can bypass wildcard deny policies to enumerate secret entry names beneath restricted paths, exposing sensitive metadata about protected resources.

Affected Products

HashiCorp Vault Community Edition prior to 2.0.3
HashiCorp Vault Enterprise prior to 2.0.3, 1.21.8, 1.20.13, and 1.19.19
Any Vault deployment relying on wildcard deny rules for LIST authorization

Discovery Timeline

2026-08-10 - CVE-2026-12624 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-12624

Vulnerability Analysis

The vulnerability resides in Vault's ACL policy evaluation logic for LIST operations. Vault normalizes request paths before matching them against policy rules, and this normalization strips trailing slashes on LIST requests. When a policy contains a broader allow rule combined with a narrower wildcard (glob) deny rule, the trailing-slash stripping causes the deny rule to be skipped during evaluation. The engine then applies only the allow rule, granting LIST access to a path that policy intended to block.

The impact is limited to information disclosure: an attacker cannot read secret values through this flaw, but can enumerate the names of entries beneath the restricted path. Exposed entry names frequently reveal service accounts, application identifiers, and internal naming schemes that assist follow-on attacks against Vault or downstream systems.

Root Cause

The root cause is inconsistent path canonicalization between allow and deny rule matching for LIST verbs. The ACL engine treats secret/restricted/ and secret/restricted as equivalent for allow evaluation but not for glob deny evaluation. This asymmetric normalization violates the least-privilege principle expected of a deny-overrides policy model.

Attack Vector

Exploitation requires an authenticated Vault token with a policy that pairs a broad allow rule with a narrower wildcard deny rule. The attacker issues a LIST request with a trailing slash appended to the denied path. The ACL engine returns the child key names instead of a permission-denied response. No user interaction, elevated privileges, or unusual client tooling is required beyond a standard Vault API client.

See the HashiCorp Security Advisory HCSEC-2026-26 for vendor technical detail.

Detection Methods for CVE-2026-12624

Indicators of Compromise

LIST requests in Vault audit logs targeting paths that end with a trailing slash and that overlap with wildcard deny rules
Successful list operations from tokens whose associated policies explicitly deny the requested path via glob
Unusual volume of LIST operations against sensitive secret mounts from a single token or client identity

Detection Strategies

Enable Vault audit devices and forward audit logs to a centralized analytics platform for correlation of LIST verbs against policy definitions
Compare successful LIST responses against the effective policy set of the requesting token to surface policy-versus-outcome mismatches
Baseline normal LIST activity per token and alert on deviations that target previously unaccessed paths

Monitoring Recommendations

Ingest Vault audit logs into a SIEM or data lake and build detections for LIST requests with trailing slashes on sensitive mounts
Alert on tokens performing LIST operations across a broad range of paths within short time windows
Review policy definitions periodically to identify allow rules that overlap with narrower wildcard deny rules

How to Mitigate CVE-2026-12624

Immediate Actions Required

Upgrade to Vault Community Edition 2.0.3 or Vault Enterprise 2.0.3, 1.21.8, 1.20.13, or 1.19.19
Inventory all ACL policies that combine broader allow rules with narrower wildcard deny rules and treat them as suspect until patched
Rotate tokens associated with policies that could have exploited the bypass if audit logs suggest enumeration occurred

Patch Information

HashiCorp addressed CVE-2026-12624 by correcting the ACL engine's path normalization so that trailing-slash stripping does not cause wildcard deny rules to be skipped on LIST requests. Fixed releases are Vault Community Edition 2.0.3 and Vault Enterprise 2.0.3, 1.21.8, 1.20.13, and 1.19.19. Refer to the HashiCorp Security Advisory HCSEC-2026-26 for release notes and upgrade guidance.

Workarounds

Rewrite affected policies to use explicit path deny rules without glob patterns for LIST-sensitive paths
Add explicit deny rules that cover both the trailing-slash and non-trailing-slash forms of restricted paths
Restrict token issuance so that policies combining broad allow with narrower wildcard deny are not granted until the patch is applied

bash

# Example: explicit deny covering both path forms until upgrade is complete
path "secret/restricted" {
  capabilities = ["deny"]
}

path "secret/restricted/*" {
  capabilities = ["deny"]
}