Loading vulnerability…
HashiCorp Vault kvv2 policy glob deletion authorization bypass DoS
CVE-2026-3605 is an authorization flaw in HashiCorp Vault affecting kvv2 paths when access is granted through a policy containing a glob. An authenticated user with access to such a kvv2 path may be able to delete secrets they are not authorized to read or write. The issue is limited to unauthorized deletion operations and results in a denial-of-service condition against affected secrets. According to the provided information, the flaw does not permit reading secret data and does not allow deletion of secrets across namespaces.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a low-privileged authenticated user to perform unauthorized deletion of secrets within the affected namespace on kvv2 paths matched through a glob-containing policy. This can disrupt applications or workflows that depend on those secrets, causing denial of service and integrity loss for secret storage. The provided information states there is no confidentiality impact because secret data cannot be read, and the issue does not enable cross-namespace deletion.
If you can’t patch tonight, do this now.
If immediate patching is not possible, review and restrict Vault policies that grant kvv2 access via glob patterns, especially where delete capability may be implicitly or incorrectly applied. Limit authenticated users' access to only explicitly authorized kvv2 paths and audit policy definitions for overbroad path matching. Monitor for unexpected secret deletions within affected namespaces. Specific vendor-recommended mitigations beyond upgrading were not provided in the available content.
Patch, then assume compromise.
Upgrade HashiCorp Vault to a fixed release. The vulnerability is fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.