Advisoriesby IbisVaultGHSA-gcqf-f89c-68hv
Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information
Fix: upgrade to 1.19.3 or later
Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/vault Go | >= 0.3.0, < 1.19.3 | 1.19.3 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-209
- Also known as
- BIT-openbao-2025-4166, BIT-vault-2025-4166, CVE-2025-4166, GO-2025-3663
More Vault advisories
All Vault
Hashicorp Vault has Login MFA Rate Limit Bypass VulnerabilityCVE-2025-6015fixed in 1.20.1Hashicorp Vault's TOTP Secrets Engine Susceptible to Code ReuseCVE-2025-6014fixed in 1.20.1Hashicorp Vault has Lockout Feature Authentication BypassCVE-2025-6004fixed in 1.20.1Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing UsersCVE-2025-6011fixed in 1.20.1Vault Community Edition rekey and recovery key operations can cause denial of serviceCVE-2025-4656fixed in 1.20.0Hashicorp Vault Community vulnerable to Incorrect AuthorizationCVE-2025-3879fixed in 1.19.1