A flaw in HashiCorp Vault allows an attacker who can authenticate and control a referenced identity value to insert slash characters into that value. These slashes are treated as additional path segments when the policy template is rendered, permitting the attacker to reach Vault paths that should be inaccessible. This results in unauthorized access and potential data exfiltration or configuration changes. The weakness is an authorization bypass through a user‑controlled key (CWE‑639). The documented severity is a CVSS score of 6.8, indicating a medium‑risk vulnerability. The attack requires an authenticated session and the ability to influence the identity field used in a templated policy path.

The vulnerability affects HashiCorp Vault Community Edition and Vault Enterprise. Fixed releases include Community Edition 2.0.4; Enterprise 2.0.4, 1.21.9, 1.20.14, and 1.19.20. All prior versions are potentially vulnerable. Administrators should verify their installed version against these patches.

Based on the description, it is inferred that exploit developers may target users with privileged roles or wildcard access rights, given the requirement for authenticated access. The CVSS score of 6.8 reflects the medium risk, and the EPSS score is currently unreported, suggesting no readily available exploit code. The vulnerability is not listed in the CISA KEV catalog. Attackers can manipulate the identity key value in a templated policy path to traverse the hierarchy, a typical path‑injection attack vector. The instruction to include slash characters is a direct injection that bypasses intended access controls. Based on the description, it is inferred that the exploit is likely to be launched from within an existing authenticated session, making it harder to mitigate by external means.