Critical Vault Secrets Operator Flaw Enables File Read and Credential Exfiltration

HashiCorp disclosed CVE-2026-8715, a critical flaw in Vault Secrets Operator that allows arbitrary file reads and credential exfiltration through the AppRole secretIDPath configuration. The vulnerability affects versions 1.3.0 through 1.4.1 and can be exploited by a tenant with limited Kubernetes RBAC permissions to read files from the operator pod filesystem and send their contents to a tenant-controlled endpoint.

The issue could expose sensitive credentials and create a path to privilege escalation inside a Kubernetes cluster. HashiCorp addressed the flaw in Vault Secrets Operator 1.5.0, and the Canadian Centre for Cyber Security issued advisory AV26-817, referencing HashiCorp bulletin HCSEC-2026-28 and urging administrators to review the advisory and apply the available update.