Home

Description

A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

PUBLISHED Reserved 2025-06-11 | Published 2025-08-01 | Updated 2025-08-01 | Assigner HashiCorp




CRITICAL: 9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Problem types

CWE-94: Improper Control of Generation of Code (Code Injection)

Product status

Default status
unaffected

0.8.0 (semver) before 1.20.1
affected

Default status
unaffected

0.8.0 (semver) before 1.20.1
affected

References

discuss.hashicorp.com/...e-code-on-the-underlying-host/76033

cve.org (CVE-2025-6000)

nvd.nist.gov (CVE-2025-6000)

Download JSON