# CVE-2026-89322: Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions

> CVE-2026-89322: Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions. CVSS 7.2 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-89322
Last updated: 2026-10-09T04:18:14Z

- Published: 2026-10-07 22:01 UTC · Updated: 2026-10-09 04:18 UTC · Assigner: HashiCorp
- CVSS: 7.2 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS: 0.30%, 22th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-178

## Description

Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy, potentially leading to privilege escalation. This vulnerability (CVE-2026-89322) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.

## Affected vendors and products

- HashiCorp: Vault
- HashiCorp: Vault Enterprise

## Tracked companies

- [HashiCorp](https://rewindex.com/company/hashicorp.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-89322)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-89322)
- [https://discuss.hashicorp.com/t/hcsec-2026-43-vault-inconsistent-acl-policy-evaluation-may-allow-bypass-of-deny-restrictions/77815](https://discuss.hashicorp.com/t/hcsec-2026-43-vault-inconsistent-acl-policy-evaluation-may-allow-bypass-of-deny-restrictions/77815)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-89322 · Markdown: https://rewindex.com/cve/CVE-2026-89322.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-89322 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:13:19.872Z