Threat database

Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [+trusted certificate+|https://developer.hashicorp.com/vault/api-docs/auth/cert#certificate]. In this configuration, an attacker may be able to craft a malicious certificate that could be used to impersonate another user. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

CVE-2025-6014 is a medium severity vulnerability in HashiCorp Vault's TOTP Secrets Engine code validation endpoint. It involves improper neutralization of whitespace, allowing code reuse within the validity period. The issue affects Vault and Vault Enterprise versions prior to the fixed releases. Official patches are available in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

CVE-2025-6004 is a medium severity vulnerability in HashiCorp Vault affecting the user lockout feature for Userpass and LDAP authentication methods. This flaw allows bypassing the lockout mechanism designed to restrict excessive authentication attempts. The issue is fixed in Vault Community Edition 1.20.1 and Vault Enterprise versions 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

CVE-2025-6000 is a critical code injection vulnerability in HashiCorp Vault that allows a privileged Vault operator with write permission to the sys/audit path in the root namespace to execute arbitrary code on the underlying host if a plugin directory is configured. This vulnerability affects certain versions of Vault and has been fixed in multiple patched releases.

CVE-2025-5999 is a privilege escalation vulnerability in HashiCorp Vault where a privileged operator with write access to the root namespace’s identity endpoint can escalate token privileges to the root policy. This vulnerability affects certain versions of Vault and has been fixed in multiple patched releases.

CVE-2025-4656 is a low-severity vulnerability in HashiCorp Vault affecting rekey and recovery key operations. It involves synchronous access of a remote resource without a timeout, which can lead to denial of service caused by uncontrolled cancellation by a Vault operator. The vulnerability has been fixed in Vault Community Edition 1.20.0 and several Enterprise versions.

Nomad Community and Nomad Enterprise (“Nomad”) prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14.

Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected. This vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0, 1.16.3, and 1.15.9