A critical vulnerability tracked as CVE-2026-8715 has been disclosed in HashiCorp's Vault Secrets Operator, scoring 9.6 on the CVSS scale. This flaw could allow for privilege escalation within Kubernetes by enabling arbitrary file reading and credential exfiltration through the AppRole's secretIDPath. Although no confirmed exploitation has occurred yet, the vulnerability impacts versions 1.3.0 to 1.4.1.
A fix has been implemented in version 1.5.0, which removes the insecure field, requiring users to migrate to using Kubernetes Secrets instead. The vulnerability exposes a significant risk as access does not require cluster-admin rights, highlighting the importance of reviewing RBAC configurations.