CVE-2026-14886
HIGH
MEDIUM
Priority: 0.03
BB Relevance:
56/100
Published: 2026-08-10
Modified: 2026-10-23
First seen: 2026-10-29
Status: active
Attack Surface
Network
No Interaction
Integ. Impact
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
Low
UI:
None
S:
Changed
C:
None
I:
High
A:
High
Description
Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability (CVE-2026-14886) is fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20.