Calculate namespace prefix before tainting route entries

changelog/24170.txt

@@ -0,0 +1,3 @@
+```release-note:bug 
+core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this.
+```

vault/auth.go

@@ -879,6 +879,7 @@ func (c *Core) setupCredentials(ctx context.Context) error {
 			// Calculate any namespace prefixes here, because when Taint() is called, there won't be
 			// a namespace to pull from the context. This is similar to what we do above in c.router.Mount().
 			path = entry.Namespace().Path + path
+			c.logger.Debug("tainting a mount due to it being marked as tainted in mount table", "path", entry.Path, "namespace_path", entry.Namespace().Path)
 			c.router.Taint(ctx, path)
 		}
 

vault/mount.go

@@ -1593,7 +1593,11 @@ func (c *Core) setupMounts(ctx context.Context) error {
 
 		// Ensure the path is tainted if set in the mount table
 		if entry.Tainted {
-			c.router.Taint(ctx, entry.Path)
+			// Calculate any namespace prefixes here, because when Taint() is called, there won't be
+			// a namespace to pull from the context. This is similar to what we do above in c.router.Mount().
+			path := entry.Namespace().Path + entry.Path
+			c.logger.Debug("tainting a mount due to it being marked as tainted in mount table", "path", entry.Path, "namespace_path", entry.Namespace().Path)
+			c.router.Taint(ctx, path)
 		}
 
 		// Ensure the cache is populated, don't need the result