Documented silent security fix: ACL Event Subscription Race (CWE-362)

[canolgun]

Not a vulnerability report — already fixed internally as VAULT-44550. Documenting a previously undisclosed fix.

• Finding: Race condition during ACL creation where event subscription could clobber policy events
• CWE: CWE-362
• Advisory: GHSA-78pw-qg9j-9mj8
• CVE: Requested via GitHub CNA

Discovered via bounty-hunter automated silent-fix detection.

[dosubot]

Hi @canolgun-commits! I'm Dosu and I'm helping the HashiCorp, an IBM Company team.

Thank you for documenting this. I want to note a few things for context:

1. VAULT-44550 was fixed in commit c7f782bf (June 8, 2026) and addresses subscribe_event_types permissions being clobbered during ACL policy merging when multiple policies apply to the same path [1]. The fix ensures existing event subscription types are preserved rather than overwritten when a subsequent policy doesn't define them.

2. Regarding the CWE-362 classification: Based on the code changes, VAULT-44550 appears to be a logic bug in sequential policy merge processing rather than a traditional concurrent execution race condition. The issue occurs when policies are merged in a specific order — if a later policy omits subscribe_event_types, it would overwrite values set by an earlier policy — not due to multiple threads accessing shared state concurrently [2].

3. The advisory GHSA-78pw-qg9j-9mj8 was filed under your personal fork (canolgun-commits/vault), not the official hashicorp/vault repository.

For any security concerns related to HashiCorp Vault, including questions about the severity or classification of fixes, please email security@hashicorp.com. The product security team handles triage and assessment of security-related matters.

Written by @dosu, approved by heatherezell

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[canolgun]

@dosubot Thank you for the clarification! Agreed — this is a sequential logic bug in policy merging, not a concurrent race condition. I'll update the classification. The fork advisory was for documentation purposes — if the HashiCorp team wants to publish an official advisory, the data is available.

[dosubot]

Thanks for the follow-up and for updating the classification! Glad the analysis was helpful. If you'd like the HashiCorp security team to review the advisory data, the best route is to email security@hashicorp.com directly — they handle triage and assessment for any security-related disclosures and can decide whether an official advisory is warranted.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.