Problem with deleting kv with ".../" name
- Dominant language
- Go
- Stars
- 36.3k
- Forks
- 4.8k
- PR merge metrics
- PR metrics pending
Description
# Unable to disable/move secrets engine with "..." in path name
## Vault Version
1.18
## Issue Description
When a secrets engine is mounted with a path containing three consecutive dots (`...`), it becomes impossible to disable, move, or perform any operations on it. The Vault API interprets `...` as containing `..` (parent directory reference) and blocks all requests as a path traversal protection measure.
## Steps to Reproduce
1. Enable a KV secrets engine with dots in the path:
```bash
vault secrets enable -path="test_.../" kv
```
2. Try to disable it:
```bash
vault secrets disable "test_.../"
```
3. Observe error:
```
Error disabling secrets engine at test_.../: Error making API request.
URL: DELETE https://127.0.0.1:8200/v1/sys/mounts/test_...
Code: 400. Errors:
* failed to scan for leases: list failed at path "": path cannot contain parent references
```
## Expected Behavior
Vault should allow disabling/moving secrets engines regardless of their path name, especially if Vault allowed creating them in the first place.
## Actual Behavior
All API operations fail with "path cannot contain parent references" error. The mount becomes permanently stuck and cannot be removed through any API or CLI method.
## Attempted Workarounds (all failed)
1. **CLI with quotes:**
```bash
vault secrets disable 'test_.../'
vault secrets disable "test_.../"
```
2. **URL encoding:**
```bash
curl --header "X-Vault-Token: $TOKEN" \
--request DELETE \
"http://127.0.0.1:8200/v1/sys/mounts/test_%2E%2E%2E"
```
3. **Move to different path first:**
```bash
vault secrets move 'test_.../' temp/
```
4. **sys/remount API:**
```bash
curl --header "X-Vault-Token: $TOKEN" \
--request POST \
--data '{"from": "test_...", "to": "temp"}' \
"http://127.0.0.1:8200/v1/sys/remount"
```
All methods fail with the same path traversal error.
## Environment
- **Storage Backend:** File
- **OS:** Ubuntu 24
- **Installation:** Standard package installation
Contributor guide
Research direction
No source files or tests are named. Reproduce the issue with the documented `vault secrets enable` and `vault secrets disable` commands, then trace handling for the `sys/mounts` and `sys/remount` API endpoints and the path-traversal check. Done means a secrets engine mounted at a path containing `...` can be disabled or moved without being rejected as a parent reference.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api, backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100