Skip to content
OpenAdvisories
High WID-SEC-2025-1702 7 CVEs

Hashicorp Vault Community und Enterprise: Mehrere Schwachstellen

Published Aug 3, 2025 · Updated Aug 3, 2025 · de-DE

Vendor: HashiCorp Product: Vault

Summary

Ein Angreifer kann mehrere Schwachstellen in Hashicorp Vault ausnutzen, um erhöhte Rechte zu erlangen, Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen und vertrauliche Informationen preiszugeben.

Product

Vault ist ein identitätsbasiertes System zur Verwaltung von Geheimnissen und Verschlüsselung.

Vulnerabilities 7

  • Critical 9.1
    CVE-2025-6000

    Arbitrary Remote Code Execution via Plugin Catalog Abuse

    A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1…

    HashiCorp Vault Enterprise Vault splunk-otel-collector Wolfi Go
  • High 7.2
    CVE-2025-5999

    Vault Root Namespace Operator May Elevate Token Privileges

    A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy. Fixed in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.…

    HashiCorp Vault Enterprise Vault splunk-otel-collector Wolfi Go
  • Medium 6.8
    CVE-2025-6037

    Vault Certificate Auth Method Did Not Validate Common Name For Non-CA Certificates

    Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [+trusted certificate+|https://developer.hashicorp.com/vault/api-docs/auth/cert#certificate]. In this …

    HashiCorp Vault Enterprise Vault splunk-otel-collector Wolfi Go
  • Medium 6.5
    CVE-2025-6014

    Vault TOTP Secrets Engine Code Reuse

    Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

    HashiCorp Vault Enterprise Vault splunk-otel-collector Wolfi Go
  • Medium 5.7
    CVE-2025-6015

    Vault Login MFA Bypass of Rate Limiting and TOTP Code Reuse

    Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

    HashiCorp Vault Enterprise Vault splunk-otel-collector Wolfi Go
  • Medium 5.3
    CVE-2025-6004

    Vault Userpass and LDAP User Lockout Bypass

    Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

    HashiCorp Vault Enterprise Vault splunk-otel-collector Wolfi Go
  • Low 3.7
    CVE-2025-6011

    Timing Side-Channel in Vault’s Userpass Auth Method

    A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s Userpass auth method. Fixed in Vault Communi…

    HashiCorp Vault Enterprise Vault splunk-otel-collector Wolfi Go

Revision history

  1. #1

    Initiale Fassung

References