CVE-2026-3605
An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
- Affected products
- Red Os, Vault Community Edition, Vault Enterprise
- Hashicorp Vault
- < 1.19.16, 2.0.0, 1.20.10, 1.21.5
- Fix
- Available
- CVSS 3.1
- 8.1 HIGH
- EPSS
- 0.4% (30th percentile)
- Weakness
- CWE-639, CWE-288
- NVD status
- Modified
- Published
- 2026-04-17
- Attack patterns
- CAPEC-126
CVE-2026-3605 at NVD
No indexed exploits for CVE-2026-3605 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-3605 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.