{"id":"CVE-2026-93335","aliases":[],"cve":{"records":[{"id":"CVE-2026-93335","source":"HashiCorp","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-17T17:54:44.624Z","published":"2026-11-12T22:32:14.454Z","modified":"2026-11-13T21:13:26.590Z"}],"publishers":[{"name":"HashiCorp","role":"CNA","organizationId":"67fedba0-ff2e-4543-ba5b-aa93e87718cc","modified":"2026-11-13T13:49:26.001Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T21:13:26.590Z"}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-56-vault-vulnerable-to-acl-deny-bypass-via-trailing-slash/78199","tags":[],"source":"HashiCorp"}],"weaknesses":[{"id":"CWE-647","description":"CWE-647: Non-Canonical URL Authorization","source":"HashiCorp"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T21:13:18.200128Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Vault vulnerable to ACL deny bypass via trailing slash","titleSource":"HashiCorp","descriptionSource":"HashiCorp","description":"Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engine, auth method, or audit device that a more specific deny rule was intended to protect. This vulnerability (CVE-2026-93335) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.","score":6.5,"severity":"medium","published":"2026-11-12T22:32:14.454Z","modified":"2026-11-13T21:13:26.590Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"HashiCorp","name":"Vault","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"versions":[{"version":"0.2.0","status":"affected","lessThan":"2.2.2","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"HashiCorp","url":"https://www.cve.org/CVERecord?id=CVE-2026-93335"},{"vendor":"HashiCorp","name":"Vault Enterprise","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"versions":[{"version":"0.2.0","status":"affected","lessThan":"2.2.2","versionType":"semver","changes":[{"at":"1.19.25","status":"unaffected"},{"at":"1.20.0","status":"affected"},{"at":"1.21.14","status":"unaffected"},{"at":"2.0.0","status":"affected"}]}],"defaultStatus":"unaffected","cpes":[],"source":"HashiCorp","url":"https://www.cve.org/CVERecord?id=CVE-2026-93335"}],"remediation":[],"references":["https://discuss.hashicorp.com/t/hcsec-2026-56-vault-vulnerable-to-acl-deny-bypass-via-trailing-slash/78199"],"sources":[{"name":"CVE","id":"CVE-2026-93335","modified":"2026-11-13T21:13:26.590Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-93335"}],"assessments":[{"source":"HashiCorp","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","score":6.5}],"sourceAffected":[],"observedAt":"2026-11-13T21:41:45.175Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:10:33.488Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-12T23:40:33.942Z","attemptedAt":"2026-11-12T23:40:33.942Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-12T23:40:33.961Z","attemptedAt":"2026-11-12T23:40:33.961Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-12T23:40:34.193Z","attemptedAt":"2026-11-12T23:40:34.193Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-12T23:40:33.820Z","attemptedAt":"2026-11-12T23:40:33.820Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-124746","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124746","modified":"Nov 12, 2026, 10:32:14 PM","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","checkedAt":"2026-11-12T23:40:34.193Z"}],"aiSummary":{"text":"Vault Community Edition and Vault Enterprise are vulnerable to an ACL deny bypass via a trailing slash, potentially allowing an authenticated user to disable protected secrets engines, auth methods, or audit devices. Affected versions are prior to 2.2.2, 1.21.14, and 1.19.25. An attacker needs authenticated access to exploit this weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T14:16:03.428Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-93335"}]}}