{"id":"CVE-2026-128100","aliases":[],"cve":{"records":[{"id":"CVE-2026-128100","source":"HashiCorp","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-12T22:16:53.115Z","published":"2026-11-13T20:10:09.065Z","modified":"2026-11-13T21:10:55.961Z"}],"publishers":[{"name":"HashiCorp","role":"CNA","organizationId":"67fedba0-ff2e-4543-ba5b-aa93e87718cc","modified":"2026-11-13T20:10:09.065Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T21:10:55.961Z"}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-58-vault-vulnerable-to-acl-deny-bypass-via-case-variant-auth-method-user-and-group-names/78256","tags":[],"source":"HashiCorp"}],"weaknesses":[{"id":"CWE-178","description":"CWE-178: Improper Handling of Case Sensitivity","source":"HashiCorp"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T21:10:47.532219Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Vault vulnerable to ACL deny bypass via case-variant auth method user and group names","titleSource":"HashiCorp","descriptionSource":"HashiCorp","description":"Vault Community Edition and Vault Enterprise did not apply explicit ACL policy deny rules to letter case variants of user and group names in auth methods that treat these names as case-insensitive. This may allow an authenticated user with delegated permissions to modify a protected user or group, potentially leading to privilege escalation. This vulnerability (CVE-2026-128100) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.","score":6.5,"severity":"medium","published":"2026-11-13T20:10:09.065Z","modified":"2026-11-13T21:10:55.961Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"HashiCorp","name":"Vault","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"versions":[{"version":"0.10.0","status":"affected","lessThan":"2.2.2","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"HashiCorp","url":"https://www.cve.org/CVERecord?id=CVE-2026-128100"},{"vendor":"HashiCorp","name":"Vault Enterprise","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"versions":[{"version":"0.10.0","status":"affected","lessThan":"2.2.2","versionType":"semver","changes":[{"at":"1.19.25","status":"unaffected"},{"at":"1.20.0","status":"affected"},{"at":"1.21.14","status":"unaffected"},{"at":"2.0.0","status":"affected"}]}],"defaultStatus":"unaffected","cpes":[],"source":"HashiCorp","url":"https://www.cve.org/CVERecord?id=CVE-2026-128100"}],"remediation":[],"references":["https://discuss.hashicorp.com/t/hcsec-2026-58-vault-vulnerable-to-acl-deny-bypass-via-case-variant-auth-method-user-and-group-names/78256"],"sources":[{"name":"CVE","id":"CVE-2026-128100","modified":"2026-11-13T21:10:55.961Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-128100"}],"assessments":[{"source":"HashiCorp","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","score":6.5}],"sourceAffected":[],"observedAt":"2026-11-13T21:28:17.597Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:20:35.359Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-13T21:16:00.961Z","attemptedAt":"2026-11-13T21:16:00.961Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-13T21:10:38.063Z","attemptedAt":"2026-11-13T21:10:38.063Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-13T21:10:37.894Z","attemptedAt":"2026-11-13T21:10:37.894Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-13T21:10:37.311Z","attemptedAt":"2026-11-13T21:10:37.311Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-125753","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125753","modified":"Nov 13, 2026, 8:10:09 PM","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","checkedAt":"2026-11-13T21:10:37.894Z"},{"source":"NVD","id":"CVE-2026-128100","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128100","modified":"2026-11-13T20:18:56.070","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","checkedAt":"2026-11-13T21:16:00.961Z"}],"aiSummary":{"text":"Vault Community Edition and Vault Enterprise are vulnerable to ACL deny bypass via case-variant auth method user and group names, potentially leading to privilege escalation. An authenticated user with delegated permissions is required. The weakness is due to improper handling of case sensitivity.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T20:56:07.477Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-128100"}]}}