hashicorp / hashicorp/vault

Problem with deleting kv with ".../" name

Open
#31,702 0 comments 0 reactions 0 assignees View on GitHub
bug secret/kv
Dominant language
Go
Stars
36.3k
Forks
4.8k
PR merge metrics
PR metrics pending

Description

# Unable to disable/move secrets engine with "..." in path name

## Vault Version
1.18

## Issue Description

When a secrets engine is mounted with a path containing three consecutive dots (`...`), it becomes impossible to disable, move, or perform any operations on it. The Vault API interprets `...` as containing `..` (parent directory reference) and blocks all requests as a path traversal protection measure.

## Steps to Reproduce

1. Enable a KV secrets engine with dots in the path:
```bash
vault secrets enable -path="test_.../" kv
```

2. Try to disable it:
```bash
vault secrets disable "test_.../"
```

3. Observe error:
```
Error disabling secrets engine at test_.../: Error making API request.

URL: DELETE https://127.0.0.1:8200/v1/sys/mounts/test_...
Code: 400. Errors:

* failed to scan for leases: list failed at path "": path cannot contain parent references
```

## Expected Behavior

Vault should allow disabling/moving secrets engines regardless of their path name, especially if Vault allowed creating them in the first place.

## Actual Behavior

All API operations fail with "path cannot contain parent references" error. The mount becomes permanently stuck and cannot be removed through any API or CLI method.

## Attempted Workarounds (all failed)

1. **CLI with quotes:**
```bash
vault secrets disable 'test_.../'
vault secrets disable "test_.../"
```

2. **URL encoding:**
```bash
curl --header "X-Vault-Token: $TOKEN" \
--request DELETE \
"http://127.0.0.1:8200/v1/sys/mounts/test_%2E%2E%2E"
```

3. **Move to different path first:**
```bash
vault secrets move 'test_.../' temp/
```

4. **sys/remount API:**
```bash
curl --header "X-Vault-Token: $TOKEN" \
--request POST \
--data '{"from": "test_...", "to": "temp"}' \
"http://127.0.0.1:8200/v1/sys/remount"
```

All methods fail with the same path traversal error.

## Environment

- **Storage Backend:** File
- **OS:** Ubuntu 24
- **Installation:** Standard package installation

Contributor guide

Open the contributing guide

Research direction

No source files or tests are named. Reproduce the issue with the documented `vault secrets enable` and `vault secrets disable` commands, then trace handling for the `sys/mounts` and `sys/remount` API endpoints and the path-traversal check. Done means a secrets engine mounted at a path containing `...` can be disabled or moved without being rejected as a parent reference.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api, backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.