high8.1
CVE-2025-11621
HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass
Impact
Vault and Vault Enterprise's ("Vault") AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS accounts, or uses a wildcard. This vulnerability is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/hashicorp/vault | >= 0.6.0, < 1.21.0 | 1.21.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hashicorp | Vault | from 0.6.0 before 1.16.27 from 0.6.0 before 1.21.0 from 1.18.0 through 1.18.15 from 1.19.0 before 1.19.11 from 1.20.0 before 1.20.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://discuss.hashicorp.com/t/hcsec-2025-30-vault-aws-auth-method-authentication-bypass-through-mishandling-of-cache-entries/76709
- https://github.com/advisories/GHSA-9g4h-h484-3578
- https://nvd.nist.gov/vuln/detail/CVE-2025-11621
- https://github.com/hashicorp/vault/commit/8d07273d14ae7f5a48cc96f66cc86615dea83390