HCSEC-2026-58 - Vault vulnerable to ACL deny bypass via case-variant auth method user and group names

Bulletin ID: HCSEC-2026-58 Affected Products / Versions: Vault and Vault Enterprise up to 2.2.1; fixed in Vault 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25. Publication Date: November 13, 2026 Summary Vault Community Edition and Vault Enterprise did not apply explicit ACL policy deny rules to letter case variants of user and group names in auth methods that treat these names as case-insensitive. This may allow an authenticated user with delegated permissions to modify a protected user or group, potentially leading to privilege escalation. This vulnerability (CVE-2026-128100) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25. Background Vault ACL policies grant or deny capabilities on API paths, and an explicit deny rule on a specific path is intended to take precedence over a broader rule that would otherwise allow access. Operators commonly combine these rules to delegate management of auth method users and groups while protecting specific higher-privilege entries. Some auth methods treat user and group names as case-insensitive, so names that differ only by letter case refer to the same user or group. Details Vault matched ACL rules against the request path as supplied, while the LDAP auth method and the RADIUS auth method when configured for case-insensitive names resolved names regardless of letter case. Vault Enterprise SCIM client updates also normalized client names to lowercase. A request that referred to a protected user, group, or SCIM client using different letter case could therefore fail to match an explicit deny rule, be authorized by a broader rule, and still act on the protected entry. This may allow a delegated user to change the policies associated with a protected user or group, which are then granted to anyone who logs in as that user or as a member of that group. This issue requires an authenticated user whose policies grant write access to the broader user, group, or SCIM client path, and a po…