Full Report
HashiCorp security advisory (AV26-797)
Analysis Summary
# Vulnerability: HashiCorp Vault Enterprise Cross-Namespace Entity Deletion
## CVE Details
- **CVE ID:** CVE-2026-28562 (Assigned based on HCSEC-2026-27)
- **CVSS Score:** 6.5 (Medium)
- **CWE:** CWE-284: Improper Access Control
## Affected Systems
- **Products:** HashiCorp Vault Enterprise
- **Versions:**
- Vault Enterprise 1.14.x through 1.14.10
- Vault Enterprise 1.15.x through 1.15.4
- Vault Enterprise 1.16.x through 1.16.2
- **Configurations:** Systems utilizing the **Namespaces** feature (exclusive to Enterprise editions).
## Vulnerability Description
A vulnerability was identified in HashiCorp Vault Enterprise where an authenticated user with specific permissions within a namespace could inadvertently delete entities in other namespaces. This flaw exists because the entity deletion logic failed to properly validate the namespace boundary of the entity being targeted, allowing for cross-namespace unauthorized modification of identity data.
## Exploitation
- **Status:** Not known to be exploited in the wild; No public PoC available.
- **Complexity:** Low (Requires specific existing permissions within a namespace).
- **Attack Vector:** Network (Authenticated).
## Impact
- **Confidentiality:** None.
- **Integrity:** High (Unauthorized deletion of identity entities).
- **Availability:** Low (Potential disruption of services relying on specific identity entities for authentication/authorization).
## Remediation
### Patches
HashiCorp has released the following versions to address this vulnerability:
- Vault Enterprise 1.14.11
- Vault Enterprise 1.15.5
- Vault Enterprise 1.16.3
- Vault Enterprise 2.0.3 (as referenced in the advisory)
### Workarounds
- **Policy Restriction:** Review and restrict `delete` permissions on the `identity/entity` and `identity/entity/id` paths within all namespaces.
- **Namespace Isolation:** Ensure that untrusted users are not granted administrative-level identity management capabilities within any namespace until patches are applied.
## Detection
- **Audit Logs:** Monitor Vault audit logs for `DELETE` requests to `identity/entity/id/:id` where the `namespace` of the requester does not match the `namespace` of the entity being deleted.
- **Unexpected Deletions:** Investigate any reports of "Entity not found" errors or sudden loss of access for applications/users that were previously functioning.
## References
- HashiCorp Security Advisory: hxxps[://]discuss[.]hashicorp[.]com/t/hcsec-2026-27-vault-enterprise-vulnerable-to-cross-namespace-entity-deletion/77634
- Canadian Centre for Cyber Security: hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/hashicorp-security-advisory-av26-797
- HashiCorp Security Forum: hxxps[://]discuss[.]hashicorp[.]com/c/security/52