CVE-2026-3605
Full vulnerability record from the local CVENow database.
Description
An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
Severity
HIGH
CVSS score
8.1
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2026-04-17 04:16:03.263000
Last modified
2026-10-26 22:10:00.163000
View original CVE JSON
{
"id": "CVE-2026-3605",
"sourceIdentifier": "[email protected]",
"published": "2026-04-17T04:16:03.263",
"lastModified": "2026-10-26T22:10:00.163",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16."
},
{
"lang": "es",
"value": "Un usuario autenticado con acceso a una ruta kvv2 a través de una política que contiene un glob podría ser capaz de eliminar secretos para los que no estaba autorizado a leer o escribir, lo que resultaría en una denegación de servicio. Esta vulnerabilidad no permitía a un usuario malintencionado eliminar secretos entre espacios de nombres, ni leer ningún dato secreto. Corregido en Vault Community Edition 2.0.0 y Vault Enterprise 2.0.0, 1.21.5, 1.20.10 y 1.19.16."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "HashiCorp",
"product": "Vault",
"defaultStatus": "unaffected",
"platforms": [
"64 bit",
"32 bit",
"x86",
"ARM",
"MacOS",
"Windows",
"Linux"
],
"repo": "https://github.com/hashicorp/vault",
"versions": [
{
"version": "0.10.0",
"lessThan": "2.0.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "HashiCorp",
"product": "Vault Enterprise",
"defaultStatus": "unaffected",
"platforms": [
"64 bit",
"32 bit",
"x86",
"ARM",
"MacOS",
"Windows",
"Linux"
],
"repo": "https://github.com/hashicorp/vault",
"versions": [
{
"version": "0.10.0",
"lessThan": "2.0.0",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "1.19.16",
"status": "unaffected"
},
{
"at": "1.20.10",
"status": "unaffected"
},
{
"at": "1.21.5",
"status": "unaffected"
}
]
}
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift4/ose-baremetal-installer-rhel9",
"cpes": [
"cpe:/a:redhat:openshift:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift4/ose-installer-rhel9",
"cpes": [
"cpe:/a:redhat:openshift:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Openshift Data Foundation 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cephcsi-rhel8",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Openshift Data Foundation 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "cephcsi-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Openshift Data Foundation 4",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "mcg-cli-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Openshift Data Foundation 4",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "mcg-rhel8-operator",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Openshift Data Foundation 4",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "mcg-rhel9-operator",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Openshift Data Foundation 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ocs4/cephcsi-rhel8",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Openshift Data Foundation 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "odf4/cephcsi-rhel8",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Openshift Data Foundation 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "odf4/cephcsi-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Openshift Data Foundation 4",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "odf4/mcg-cli-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Openshift Data Foundation 4",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "odf4/mcg-rhel8-operator",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Openshift Data Foundation 4",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "odf4/mcg-rhel9-operator",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.2
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-17T13:20:23.015074Z",
"id": "CVE-2026-3605",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-288"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-639"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "0.10.0",
"versionEndExcluding": "1.19.16",
"matchCriteriaId": "A10F062C-C575-44AF-B8A5-90E3BD34D2E7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
"versionStartIncluding": "0.10.0",
"versionEndExcluding": "2.0.0",
"matchCriteriaId": "8A5E6BEF-C182-4E5D-A908-2CD2F2437205"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "1.20.0",
"versionEndExcluding": "1.20.10",
"matchCriteriaId": "E2135CCF-F6D8-41AC-8D0C-F763F63974B4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "1.21.0",
"versionEndExcluding": "1.21.5",
"matchCriteriaId": "C8097BD2-0B19-4BA7-930E-93A5A89EC4AF"
}
]
}
]
}
],
"references": [
{
"url": "https://discuss.hashicorp.com/t/hcsec-2026-05-vault-kvv2-metadata-and-secret-deletion-policy-bypass-denial-of-service/77342",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-3605",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459105",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3605.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
]
}