Advisoriesby IbisVaultGHSA-9g4h-h484-3578
HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass
Fix: upgrade to 1.21.0 or later
Vault and Vault Enterprise's ("Vault") AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS accounts, or uses a wildcard. This vulnerability is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/vault Go | >= 0.6.0, < 1.21.0 | 1.21.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-288
- Also known as
- BIT-vault-2025-11621, CVE-2025-11621, GO-2025-4070
More Vault advisories
All Vault
Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSONCVE-2025-12044fixed in 1.21.0HashiCorp Vault Community Edition Denial of Service Though Complex JSON PayloadsCVE-2025-6203fixed in 1.20.3HashiCorp Vault ldap auth method may not have correctly enforced MFACVE-2025-6013fixed in 1.20.2Hashicorp Vault has Incorrect Validation for Non-CA CertificatesCVE-2025-6037fixed in 1.20.1Hashicorp Vault has Privilege Escalation VulnerabilityCVE-2025-5999fixed in 1.20.0Hashicorp Vault has Code Execution Vulnerability via Plugin ConfigurationCVE-2025-6000fixed in 1.20.1