CVE-2026-14886 in Vault Enterprise
Summary
by MITRE • 08/10/2026
Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability (CVE-2026-14886) is fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability identified as CVE-2026-14886 represents a critical authorization bypass flaw within HashiCorp Vault Enterprise's identity management system. This issue specifically affects the batch-delete endpoint functionality within the identity entity service, creating a dangerous condition where proper namespace isolation can be circumvented. The flaw allows authenticated users from one namespace to execute deletion operations against entities belonging to different namespaces, fundamentally undermining the security model that Vault employs to isolate tenant data and maintain multi-tenant security boundaries.
The technical root cause of this vulnerability lies in insufficient access control validation within the batch-delete endpoint implementation. When processing delete requests for multiple identity entities, the system fails to properly verify that the requesting user has authorization rights to modify entities across namespace boundaries. This authorization gap occurs during the validation phase where the system should enforce namespace-specific permissions but instead permits cross-namespace operations to proceed. The vulnerability manifests as a failure in the access control decision logic that should prevent authenticated users from acting beyond their designated namespace scope, creating a pathway for unauthorized data destruction.
The operational impact of this vulnerability extends far beyond simple data loss scenarios and represents a significant threat to multi-tenant security environments. An attacker with valid credentials in one namespace could potentially delete critical identity entity storage data belonging to other namespaces, leading to complete loss of user identities, authentication records, and associated access control information. This compromise affects the integrity and availability of the entire Vault deployment, as the deletion operations are permanent and cannot be easily reversed. The vulnerability particularly impacts organizations relying on Vault Enterprise for managing complex multi-tenant environments where namespace isolation is critical for compliance and security requirements.
Organizations utilizing Vault Enterprise must implement immediate mitigations to address this vulnerability through the recommended software updates that have been released in versions 2.0.4, 1.21.9, 1.20.14, and 1.19.20. These updates contain patched access control logic specifically designed to enforce proper namespace boundaries during batch-delete operations. The fix aligns with security best practices outlined in the CWE-284 Access Control Vulnerability category, which emphasizes the importance of proper authorization checks for sensitive operations. From an ATT&CK framework perspective, this vulnerability maps to techniques involving privilege escalation and data destruction, representing a significant threat to the confidentiality, integrity, and availability of identity management systems within enterprise environments. Organizations should also consider implementing additional monitoring controls to detect unauthorized deletion activities and establish emergency response procedures to address potential exploitation attempts.
The vulnerability demonstrates how seemingly routine administrative operations can expose critical security weaknesses when proper access control boundaries are not maintained. This flaw specifically relates to the improper enforcement of namespace isolation, which is fundamental to multi-tenant system security models. The fix addresses the core authorization bypass by strengthening the validation logic for batch operations and ensuring that all delete requests undergo proper namespace scope verification. Security teams should conduct thorough assessments of their Vault deployments to confirm proper patching and validate that access control configurations correctly enforce namespace boundaries. Regular security audits of identity management systems remain crucial for identifying similar authorization bypass vulnerabilities that could compromise multi-tenant environments and user data integrity across enterprise infrastructure deployments.