HashiCorp Vault Flaws Enable Policy Bypass and Unauthenticated DoS

HashiCorp disclosed two security issues in Vault affecting availability and access controls. One advisory, HCSEC-2026-05, warns that Vault's KVv2 engine is vulnerable to a policy bypass involving metadata and secret deletion operations, creating a denial-of-service condition and allowing actions that should have been restricted by policy.

A second advisory, HCSEC-2026-08, says Vault is also vulnerable to denial of service through unauthenticated root token generation and rekey operations. Together, the disclosures indicate that both authenticated policy enforcement paths and unauthenticated operational workflows in Vault can be abused to disrupt service, underscoring the need for organizations running Vault to review affected deployments and apply vendor guidance promptly.