Quick answers
- Is CVE-2026-93335 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-93335 being exploited in the wild.
- How severe is CVE-2026-93335?
- Medium severity, with a CVSS score of 6.5, published 13 November 2026.
- Which products and versions are affected?
- HashiCorp Vault Community Edition up to 2.2.1; HashiCorp Vault Enterprise up to 2.2.1, 1.21.13, 1.19.24.
- Is there a fix for CVE-2026-93335?
- Yes: fixed in Vault Community Edition 2.2.2; Vault Enterprise 2.2.2, 1.21.14, 1.19.25. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-93335 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-93335?
- Check whether you run HashiCorp Vault Community Edition or HashiCorp Vault Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Vault Community Edition 2.2.2; Vault Enterprise 2.2.2, 1.21.14, 1.19.25
Technical details
Vault's ACL engine matches exact-path and segment-wildcard rules against request paths but treats paths with and without trailing slashes as distinct for matching purposes, while the underlying system treats them as the same resource. An authenticated user whose policies grant delete on a broad path (e.g., all secrets engines) can use the alternate slash form to bypass a more specific explicit deny rule on a narrower path, then disable that protected resource. This requires the user to hold broader delete permission and, for auth methods and audit devices, sudo capability.
Affected products
- HashiCorp Vault Community Edition up to 2.2.1
- HashiCorp Vault Enterprise up to 2.2.1, 1.21.13, 1.19.24
Timeline
- 2026-11-12: disclosed