HashiCorp Vault contains an authorization bypass vulnerability that allows authenticated users to perform unauthorized deletions of sensitive secrets, resulting in service disruption.

This vulnerability involves a flaw in policy enforcement where an authenticated user with access to a kvv2 path via a glob pattern can delete secrets they are not explicitly permitted to read or write. The issue is classified under CWE-288, indicating an authentication bypass using an alternate path or channel.

The vulnerability carries a CVSS score of 8.1, reflecting a high impact on system availability and integrity. Successful exploitation could lead to significant operational downtime as attackers delete critical secrets, potentially halting automated workflows or application deployments that rely on Vault for credential management. While the flaw does not permit reading secret data or cross-namespace deletion, the resulting denial of service poses a severe threat to business continuity.

Immediate Action: Upgrade to Vault Community Edition 2.0.0, or for Enterprise users, upgrade to versions 2.0.0, 1.21.5, 1.20.10, or 1.19.16 as provided by the vendor.

Proactive Monitoring: Review Vault audit logs for suspicious deletion patterns, specifically targeting requests originating from users with glob-based policy access.

Compensating Controls: Restrict access to policies utilizing glob patterns to the minimum set of users required and ensure that administrative oversight is applied to any policy changes involving sensitive KV secret engines.

Public Exploit Available: No — there is no confirmed public exploit or proof-of-concept available for this vulnerability.

Given the high CVSS severity and the potential for disruptive denial of service, organizations should prioritize patching their Vault instances. Administrators must verify their current version against the fixed releases and apply the necessary security updates to prevent unauthorized secret deletion. If immediate patching is not feasible, restrict the scope of policies using glob patterns to limit the potential impact until the update can be deployed.