High severity · published Aug 10, 2026
CVE-2026-14886
Vault Enterprise vulnerable to cross-namespace entity deletion
8.2
CVSS
0.3%
EPSS
No
On KEV
Description
Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability (CVE-2026-14886) is fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VE
Vault Enterprise · HashiCorp
2.0.0 before 2.0.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-14886
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-14886
discuss.hashicorp.com
https://discuss.hashicorp.com/t/hcsec-2026-27-vault-enterprise-vulnerable-to-cross-namespace-entity-deletion/77634
More from Vault Enterprise
8.8
CVE-2026-4525
Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header
8.6
CVE-2026-5052
Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS
8.1
CVE-2026-3605
Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service
8.0
CVE-2026-105816
Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots
7.5
CVE-2026-5807
Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations