Additionally to the ones previously mentioned, consider boquete, aspillera and grieta.
While aspillera is not the most colloquial word to use, it is the closest there is to loophole as the definition for both of them is:
An arrow slit in a wall.
Aspillera is derived from the latin sagitta, which means "arrow" (yes, Sagittarius, "the archer", derives from it, too) and it is a narrow opening that goes deep into a thick defensive wall such as those used to protect castles.
Based on that, a loophole could be seen as a small opening, in an otherwise solid defensive structure, which can be exploited to bypass its defenses.
Boquete, on the other hand, is not exactly an arrow slit in a wall but it is
a small opening that provides entry to an otherwise inaccessible
place.
While boquete derives from "boca" (mouth), the meaning behind it is closely related to that of a loophole.
Moreover, legal loopholes are often referred to as boquetes legales in Spanish. The word boquete is usually associated with malicious intent since "breaching" in Spanish is to "create a boquete", and thus it is associated with criminal activities since it is a habitual technique in burglary.
Lastly, grieta is a crack, which can also be associated to an exploitable small opening and is also used to refer to legal loopholes in Spanish as grietas legales.
Please notice that the links provided show examples of native usages of the terms, instead of translations of an existing article. Both boquete and grieta can be used for IT-related security; as a matter of fact, the first place where I heard the term was in an academic discussion about computer science.
