vaultGHSA-6c5r-4wfc-3mcx
Hashicorp Vault has Incorrect Validation for Non-CA Certificates
Medium6.8CVE-2025-6037 · Published Aug 1, 2025 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/vault Go | < 1.20.1 | 1.20.1 |
Details and references
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [+trusted certificate+|https://developer.hashicorp.com/vault/api-docs/auth/cert#certificate]. In this configuration, an attacker may be able to craft a malicious certificate that could be used to impersonate another user. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-295
- Also known as
- BIT-vault-2025-6037, CVE-2025-6037, GO-2025-3836
More vault advisories
All| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 12025 | Hashicorp Vault has Privilege Escalation Vulnerability CVE-2025-5999High7.2fixed in 1.20.0 | High7.2 | 1.20.0 |
| Aug 12025 | Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration CVE-2025-6000Critical9.1fixed in 1.20.1 | Critical9.1 | 1.20.1 |
| Aug 12025 | Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing Users CVE-2025-6011Low3.7fixed in 1.20.1 | Low3.7 | 1.20.1 |
| Aug 12025 | Hashicorp Vault has Lockout Feature Authentication Bypass CVE-2025-6004Medium5.3fixed in 1.20.1 | Medium5.3 | 1.20.1 |
| Aug 12025 | Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse CVE-2025-6014Medium6.5fixed in 1.20.1 | Medium6.5 | 1.20.1 |
| Aug 12025 | Hashicorp Vault has Login MFA Rate Limit Bypass Vulnerability CVE-2025-6015Medium5.7fixed in 1.20.1 | Medium5.7 | 1.20.1 |