CVE-2026-3605

OVERVIEW CVE-2026-3605 affects HashiCorp Vault Community Edition 2.0.0 and Vault Enterprise versions 1.19.x through 2.0.0 prior to their patched releases. The vulnerability permits authenticated users with policy-based glob access to kvv2 paths to delete secrets outside their authorization scope, resulting in denial-of-service conditions. Notably, the vulnerability does not enable cross-namespace secret deletion or unauthorized secret data disclosure. SEVERITY This vulnerability carries a CVSS score of 8.1 (High) with a network-based attack vector requiring low complexity and low privileges, meaning any authenticated user can exploit it remotely without special conditions. The primary impact is high availability degradation through unauthorized secret deletion, though confidentiality remains unaffected. The EPSS score of 0.00014 indicates minimal probability of exploitation in the wild relative to other disclosed vulnerabilities. EXPLOITATION STATUS There is no evidence of active exploitation. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities catalog and remains inactive on vulnerability hot lists. No public exploit code availability has been reported. The relatively low EPSS probability and lack of public attention suggest limited real-world exploitation risk at this time.