Vault’s access control list engine omitted consistent enforcement of a wildcard deny rule against LIST requests that include a trailing slash on a path that should be denied. A token that has a broader allow rule and a narrower wildcard deny can use a LIST call to enumerate the names of entries below the denied path, exposing internal structure and possibly sensitive keys.

The flaw affects HashiCorp Vault Community Edition and Enterprise. Versions earlier than 2.0.3 of the Community Edition and earlier than 1.21.8, 1.20.13, or 1.19.19 of the Enterprise edition are affected. The vulnerability is fixed in Vault CE 2.0.3 and Vault Enterprise 2.0.3, 1.21.8, 1.20.13, 1.19.19.

The CVSS score is 4.3, indicating low severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated token that is granted a broad allow rule and a narrow deny rule; the attacker can then issue a LIST request with a trailing slash to enumerate sub‑paths. The attack is feasible over Vault’s HTTP API and is most relevant in environments where tokens are broadly granted or where policy misconfiguration exists.