Description
Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HashiCorp | Vault | 0.3.0 – < 1.19.2 | 1.19.2 |
| HashiCorp | Vault Enterprise | 0.10.0 – < 1.19.2 | 1.19.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250506T153719-1.1 | openSUSE-SU-2025:15059-1 |
| openSUSE Tumbleweed | openbao | 2.2.2-1.1 | openSUSE-SU-2025:15186-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | openbao | 2.2.2-r0 | — |
| Alpine v3.23 | openbao | 2.2.2-r0 | — |
| Alpine v3.22 | openbao | 2.2.2-r0 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | splunk-otel-collector +2 | 0.125.0-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/hashicorp/vault | >= 0.3.0, < 1.19.3 | 1.19.3 | GHSA-gcqf-f89c-68hv |
Advisories 3
- openSUSE-SU-2025:15186-1 openbao-2.2.2-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15059-1 govulncheck-vulndb-0.0.20250506T153719-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-0933 Hashicorp Vault: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 4, 2025