CVE-2026-3605Disclosure(hashicorp / vault)

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch hashicorp vault systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

hashicorp CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://discuss.hashicorp.com/t/hcsec-2026-05-vault-kvv2-metadata-and-secret-deletion-policy-bypass-denial-of-service/77342

Other references

Weakness type (CWE)

CWE-288CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

vault

Threat summary

Patch or workaround signal is available
3 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
Peaked 1d ago at 2 mentions (2026-04-17); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

hashicorp

Products

vault

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

Patch

133.3%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-17	2	Disclosure2
2026-04-27	1	Patch1

Full discourse3 posts

Giuseppe Paternicola@giuseppe_1337164d
Patch
🚨 HIGH: CVE-2026-3605 (CVSS 8.1) - HashiCorp Vault KVv2 privilege escalation. Authenticated users with glob policy access can delete unauthorized secrets, causing DoS. Fixed in Vault 2.0.0+. Patch immediately. #CVE #Vulnerability #PatchNow https://t.co/oihHfy8ht1
Post summary
The tweet discloses a high-severity CVE-2026-3605 affecting HashiCorp Vault KVv2, describing a privilege escalation that can cause DoS through unauthorized secret deletion, and urges immediate patching to Vault 2.0.0+.
0000047
27 followersView on X
CVE@CVEnew174d
Disclosure
CVE-2026-3605 An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting i… https://www.cve.org/CVERecord?id=CVE-2026-3605
Post summary
The text announces CVE-2026-3605, noting a privileged user can delete unauthorized secrets via glob paths; no PoC, exploit code, patch, or active exploitation details are provided.
0000064
57.2K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds174d
Disclosure
CVE-2026-3605 Authenticated Secret Deletion Vulnerability in HashiCorp Vault KVv2 Path https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3605
Post summary
The post announces CVE-2026-3605, detailing an authenticated secret deletion flaw in HashiCorp Vault's KVv2 path, without providing PoCs, exploits, patches, or evidence of active exploitation.
0000059
4.0K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	hashicorp	vault	-	-	-
App	hashicorp	vault	-	-	-

Explore more

Back to dashboard hashicorp CVEs vault vulnerabilities