GHSA-m2w4-8ggf-rj47

Suggest an improvement
Source
https://github.com/advisories/GHSA-m2w4-8ggf-rj47
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-m2w4-8ggf-rj47/GHSA-m2w4-8ggf-rj47.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-m2w4-8ggf-rj47
Aliases
Downstream
Published
2026-04-17T06:31:07Z
Modified
2026-04-21T13:12:56.139568448Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service
Details

An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

Database specific 
{
    "github_reviewed": true,
    "severity": "HIGH",
    "github_reviewed_at": "2026-04-18T00:51:47Z",
    "nvd_published_at": "2026-04-17T04:16:03Z",
    "cwe_ids": [
        "CWE-288"
    ]
}
References

Affected packages

Go / github.com/hashicorp/vault

Package

Name
github.com/hashicorp/vault
View open source insights on deps.dev
Purl
pkg:golang/github.com/hashicorp/vault

Affected ranges

Type
SEMVER
Events
Introduced
0.10.0
Last affected
1.21.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-m2w4-8ggf-rj47/GHSA-m2w4-8ggf-rj47.json"