CVE-2026-14886: Vault Enterprise Auth Bypass Vulnerability

CVE-2026-14886 Overview

CVE-2026-14886 is a cross-namespace authorization bypass in HashiCorp Vault Enterprise. The identity entity batch-delete endpoint fails to enforce namespace boundaries. An authenticated caller in one namespace can permanently delete the storage backing of entities that belong to a different namespace.

The flaw is classified as [CWE-862] Missing Authorization. HashiCorp addressed the issue in Vault Enterprise 2.0.4, 1.21.9, 1.20.14, and 1.19.20.

Critical Impact
An attacker with low-privilege credentials in one Vault namespace can destroy identity entity storage across tenant boundaries, breaking authentication and access control for unrelated workloads.

Affected Products

HashiCorp Vault Enterprise versions prior to 2.0.4
HashiCorp Vault Enterprise versions prior to 1.21.9, 1.20.14, and 1.19.20
Vault Enterprise deployments using multi-tenant namespaces

Discovery Timeline

2026-08-10 - CVE-2026-14886 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-14886

Vulnerability Analysis

Vault Enterprise supports namespaces to isolate secrets, policies, and identities across tenants. The identity subsystem tracks entities that represent authenticated users and applications. Vault exposes a batch-delete endpoint that accepts a list of entity identifiers for removal.

The batch-delete handler does not validate that each supplied entity identifier resides within the caller's namespace. When Vault processes the request, it resolves entities by ID globally and removes their storage records. This lets an authenticated caller in one namespace delete identity entities owned by another namespace.

Deletion is destructive because the endpoint targets the underlying storage backing rather than metadata alone. Downstream authentication mounts, aliases, and group memberships tied to the removed entities break. Workloads dependent on those identities lose access and cannot re-authenticate until administrators rebuild the affected records.

Root Cause

The root cause is a missing authorization check [CWE-862] on the batch-delete code path. The handler treats entity IDs as globally addressable and skips the namespace scoping enforced on other identity operations. Any authenticated principal with permission to call the batch-delete endpoint in any namespace can target entities anywhere in the cluster.

Attack Vector

The attack requires network access to the Vault API and a valid token in any namespace with permission to invoke the identity entity batch-delete endpoint. The attacker enumerates or guesses entity IDs belonging to other namespaces, then submits them in a batch-delete request. Vault removes the storage backing without a scope check, causing loss of integrity and availability for the victim namespace.

No verified public exploit is available. The vulnerability mechanism is documented in the HashiCorp Security Advisory HCSEC-2026-27.

Detection Methods for CVE-2026-14886

Indicators of Compromise

Audit log entries for identity/entity/batch-delete requests originating from tokens scoped to a namespace different from the affected entities.
Unexpected disappearance of identity entities, aliases, or group memberships without a corresponding administrative action.
Authentication failures or lost token bindings for workloads that previously operated normally.

Detection Strategies

Enable Vault audit devices and forward logs to a centralized analytics platform for review of every call to identity entity delete endpoints.
Correlate batch-delete requests with the caller's namespace and the namespace of each targeted entity ID to flag cross-namespace deletions.
Alert on high-volume delete operations against the identity subsystem, especially from non-administrative tokens.

Monitoring Recommendations

Ingest Vault audit logs into an analytics platform such as the SentinelOne Singularity Data Lake for retention, correlation, and long-term hunting.
Track baseline rates of identity entity mutations and generate alerts on deviations.
Monitor Vault Enterprise version banners across the fleet to identify unpatched nodes.

How to Mitigate CVE-2026-14886

Immediate Actions Required

Upgrade Vault Enterprise to 2.0.4, 1.21.9, 1.20.14, or 1.19.20 depending on the deployed release branch.
Audit existing policies that grant update or create capability on identity/entity/batch-delete and restrict them to trusted operators.
Review audit logs for any prior cross-namespace batch-delete activity and validate identity entity inventories against known-good backups.

Patch Information

HashiCorp fixed CVE-2026-14886 in Vault Enterprise 2.0.4, 1.21.9, 1.20.14, and 1.19.20. Details are published in the HashiCorp Security Advisory HCSEC-2026-27.

Workarounds

Remove or tightly scope any policy granting write access to identity/entity/batch-delete until the upgrade is complete.
Restrict Vault API access to trusted networks and rotate any tokens held by parties who do not require identity administration.
Take a fresh snapshot of Vault storage before upgrading so that identity entities can be restored if tampering is discovered.

bash

# Example: remove batch-delete capability from a namespace-scoped policy
vault policy write restricted-identity - <<EOF
path "identity/entity/batch-delete" {
  capabilities = ["deny"]
}
EOF