Root privilege escalation via normalized policy names

Privilege escalation in HashiCorp Vault and Vault Enterprise allows remote authenticated users to grant valid tokens the root policy. Policy-name normalization and incomplete input validation let a root-namespace identity API write assign the reserved root policy to an entity, although normal writes permit only existing non-root policies. Exploitation requires privileged write access to the root namespace's identity endpoint, and elevated privileges last only for the affected token's remaining validity.