CVE-2026-3605
highPriorität · verfolgen · 0OT-Risiko · erhöhtEPSS 0.004 · 31. PerzentilDEEURUUSEPSS · bewertet 2026-10-27
An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (26)
Betroffene Produkte und Versionsbereiche.
Advisories (4)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2026-1164Hashicorp Vault Community Edition und Enterprise: Mehrere SchwachstellenDeutsch2026-04-16csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Hashicorp Vault ausnutzen, um Daten zu manipulieren, einen Denial-of-Service-Zustand zu verursachen oder vertrauliche Informationen offenzulegen, was möglicherweise eine Privilegienerweiterung ermöglicht.
- GHSA-m2w4-8ggf-rj47HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service2026-04-17ghsa · osvUS
An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
- BIT-vault-2026-3605Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service2026-04-21vendor · osvUS
An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
- GO-2026-5487HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service in github.com/hashicorp/vault2026-06-25vendor · osvUS
HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service in github.com/hashicorp/vault
auch bekannt als (7)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (8)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2026-3605cnnvd
- https://discuss.hashicorp.com/t/hcsec-2026-05-vault-kvv2-metadata-and-secret-deletion-policy-bypass-denial-of-service/77342Patchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2026-3605cnnvd
- https://discuss.hashicorp.com/t/hcsec-2026-05-vault-kvv2-metadata-and-secret-deletion-policy-bypass-denial-of-service/77342enisa_euvd
- https://access.redhat.com/security/cve/CVE-2026-3605nvd
- https://bugzilla.redhat.com/show_bug.cgi?id=2459105nvd
- https://discuss.hashicorp.com/t/hcsec-2026-05-vault-kvv2-metadata-and-secret-deletion-policy-bypass-denial-of-service/77342Vendor Advisorynvd
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3605.jsonnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan