A service token is updated and later can enumerate secrets but cannot actually read the intended values from Vault.
A Vault policy looks permissive and KV reads still fail because the team granted metadata paths while the application uses data paths on a versioned KV v2 mount
The token can list and inspect metadata, yet the real secret read fails because the path family is wrong for KV v2 access.
Scenario
What to check first
- Identify the primary failure signal in the The Policy Opened the Secret Catalog but Not the Secret Itself scenario.
- Separate visible symptoms from the underlying technical dependency.
- Describe the safest recovery path and the follow-up prevention work.
Checking checklist
- Summarize the current impact and the last known change.
- Collect direct evidence from logs, runtime state, and configuration before changing anything.
- Separate immediate recovery from permanent prevention work.
Recovery and prevention
Validate KV v2 path semantics before broadening token capabilities across the mount.
Questions worth viewing together
Community-field security problem inspired by HashiCorp Discuss threads where KV v2 policies allowed metadata paths but blocked actual data reads. Vault path issues often look like auth failures even when the token is otherwise valid.
Teams often blame expired tokens when the policy simply points at metadata instead of data.
KV v2 pathing doubles the room for mistakes because metadata and data are separate APIs.
Similar cases seen in the field