AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

HashiCorpCVE-2026-14886

HashiCorp Vault Enterprise: missing authorization

HashiCorp

CVE-2026-14886 · Published Aug 10, 2026 · updated Aug 28, 2026

High8.2
Fix: upgrade to 2.0.4 or later
HashiCorp advisory

Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability (CVE-2026-14886) is fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20.

Affected versions

PackageAffectedFixed in
Vault Enterprise
Product
>= 2.0.0, < 2.0.42.0.4
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-862

More HashiCorp advisories

All HashiCorp
Medium 4.3Aug 10HashiCorp Vault: improper authorizationCVE-2026-12624fixed in 2.0.3 +1High 7.5Aug 7HashiCorp Consul: denial of serviceCVE-2026-15972fixed in 2.0.3 +1Medium 5.3Aug 7HashiCorp Consul: denial of serviceCVE-2026-19012fixed in 2.0.3 +1Medium 4.3Aug 7HashiCorp Consul: resource exhaustionCVE-2026-19014fixed in 2.0.3 +1Medium 5.3Aug 7HashiCorp Consul: resource exhaustionCVE-2026-19015fixed in 2.0.3 +1Medium 4.2Aug 7HashiCorp Consul: path traversalCVE-2026-19016fixed in 2.0.3 +1