MEDIUMCVSS v3.1 6.5Vulnerability
CVE-2026-128100
Vault Community Edition and Vault Enterprise did not apply explicit ACL policy deny rules to letter case variants of user and group names in auth methods that treat these names as case-insensitive. This may allow an authenticated user with delegated permissions to modify a protected user or group, potentially leading to privilege escalation. This vulnerability (CVE-2026-128100) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Cvss severity
- MEDIUM
- Cvss score
- 6.5
- Retrieved at
- 2026-11-14T00:50:05+00:00
- Score
- 6.5
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-128100
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
- First seen by Signal
- 2026-11-13T20:38:23+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
- Published at
- 2026-11-13T20:18:56.070
- Last modified
- 2026-11-13T21:17:43.890
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph