Is CVE-2026-3605 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3605 being exploited in the wild.

How severe is CVE-2026-3605?

High severity, with a CVSS score of 8.1, published 17 April 2026.

Which products and versions are affected?

github.com/hashicorp/vault (Go) >= 0.10.0, <= 1.21.4, SEMVER:introduced=0.10.0, SEMVER:introduced=0.10.0,last_affected=1.21.4; HashiCorp Vault Community Edition 0.10 up to 1.21.4, fixed in 2.0.0, 0.10.0 to 1.21.4; HashiCorp Vault Enterprise 0.10 up to 1.21.4, 1.20.9, 1.19.15; fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16, 0.10.0 to 1.19.15, 1.20.0 to 1.20.9, 1.21.0 to 1.21.4.

Is there a fix for CVE-2026-3605?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-3605 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-3605?

Check whether you run github.com/hashicorp/vault (Go), HashiCorp Vault Community Edition or HashiCorp Vault Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3605: HashiCorp Vault policy bypass in KVv2 secrets engine

Q: Is there a fix for CVE-2026-3605?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-3605 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-3605?

Check whether you run github.com/hashicorp/vault (Go), HashiCorp Vault Community Edition or HashiCorp Vault Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3605 · Severity: high · CVSS 8.1 · Published 2026-04-17

HashiCorp Vault is a tool used to securely store and manage sensitive information like passwords and encryption keys. A vulnerability was found where an authorized user could bypass security policies to delete secrets they should not have access to. While this does not allow the attacker to read the secret data, it can lead to a denial-of-service by permanently removing critical credentials required for business operations.

Technologies: github.com/hashicorp/vault (Go), HashiCorp Vault Community Edition, HashiCorp Vault Enterprise. Vendors: Go, HashiCorp.

Quick answers

Is CVE-2026-3605 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3605 being exploited in the wild.
How severe is CVE-2026-3605?: High severity, with a CVSS score of 8.1, published 17 April 2026.
Which products and versions are affected?: github.com/hashicorp/vault (Go) >= 0.10.0, <= 1.21.4, SEMVER:introduced=0.10.0, SEMVER:introduced=0.10.0,last_affected=1.21.4; HashiCorp Vault Community Edition 0.10 up to 1.21.4, fixed in 2.0.0, 0.10.0 to 1.21.4; HashiCorp Vault Enterprise 0.10 up to 1.21.4, 1.20.9, 1.19.15; fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16, 0.10.0 to 1.19.15, 1.20.0 to 1.20.9, 1.21.0 to 1.21.4.
Is there a fix for CVE-2026-3605?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-3605 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-3605?: Check whether you run github.com/hashicorp/vault (Go), HashiCorp Vault Community Edition or HashiCorp Vault Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A policy bypass vulnerability exists in HashiCorp Vault's KVv2 secrets engine. Due to separate request flows for metadata and data, an authenticated user with a policy containing a glob pattern can bypass intended restrictions to delete secrets or metadata they are not authorized to modify. The attack requires the user to have some level of authenticated access to a KVv2 path. While the vulnerability allows for unauthorized deletion (Denial of Service), it does not permit unauthorized reading of secret data or cross-namespace deletion. The fix involves enforcing canonical paths for all KVv2 data and metadata requests.

Affected products

HashiCorp Vault Community Edition 0.10 up to 1.21.4, fixed in 2.0.0
HashiCorp Vault Enterprise 0.10 up to 1.21.4, 1.20.9, 1.19.15; fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16

Identifiers

CVE-2026-3605
GHSA-m2w4-8ggf-rj47
GO-2026-5487

Timeline

2026-04-16: advisory: HashiCorp published HCSEC-2026-05
2026-04-17: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.