An authentication and authorization flaw in HashiCorp Vault allows an authenticated user with a glob‑based policy on a kvv2 path to delete secrets they are not authorized to remove, which can cause downtime for the service. The vulnerability does not provide cross‑namespace deletion or allow reading of secret data; it is a denial‑of‑service scenario rooted in insufficient permission checks (CWE-288).

HashiCorp Vault Community Edition 2.0.0 and HashiCorp Vault Enterprise versions 2.0.0, 1.21.5, 1.20.10, and 1.19.16 are affected by this policy bypass. Users running these releases without updating are exposed to the described deletion issue.

The CVSS score of 8.1 indicates a high severity impact, and the lack of an EPSS score or KEV listing suggests no known widespread exploitation yet, though the absence of limitations on delete permissions makes the vulnerability readily exploitable in environments with misconfigured glob policies. An attacker must be authenticated and have policy access to the vulnerable path, but does not need any special administrative privileges beyond normal policy rights, increasing the likelihood of exploitation if privileges are misassigned.