High severity · published Aug 10, 2026
CVE-2026-14886
Vault Enterprise vulnerable to cross-namespace entity deletion
8.2
CVSS
0.3%
EPSS
No
On KEV
Description
Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability (CVE-2026-14886) is fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VE
Vault Enterprise · HashiCorp
2.0.0 before 2.0.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-14886
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-14886
discuss.hashicorp.com
https://discuss.hashicorp.com/t/hcsec-2026-27-vault-enterprise-vulnerable-to-cross-namespace-entity-deletion/77634
More from Vault Enterprise
9.8
CVE-2024-2048
Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates
9.1
CVE-2025-6000
Arbitrary Remote Code Execution via Plugin Catalog Abuse
8.8
CVE-2026-4525
Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header
8.8
CVE-2025-3879
Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login
8.8
CVE-2024-7594
Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default