CVE-2025-11621: vault from 0.6.0 (inclusive), before 1.16.27 (exclusive), from 0.6.0 (inclusive), before 1.21.0 (exclusive), from…

Affected technology

vault · from 0.6.0 (inclusive), before 1.16.27 (exclusive)
hashicorp

vault · from 0.6.0 (inclusive), before 1.21.0 (exclusive)
hashicorp

vault · from 1.18.0 (inclusive), through 1.18.15 (inclusive)
hashicorp

vault · from 1.19.0 (inclusive), before 1.19.11 (exclusive)
hashicorp

vault · from 1.20.0 (inclusive), before 1.20.5 (exclusive)
hashicorp

Vault · 0.6.0 to before 1.21.0
HashiCorp

Vault Enterprise · 0.6.0 to before 1.21.0; status changes: 1.20.5 — unaffected, 1.19.11 — unaffected, 1.16.27 — unaffected
HashiCorp

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could get past authentication checks under the conditions described by the source. Vendor/CNA’s CVSS 3.1 assessment (base score 8.1/10) rates confidentiality and integrity impact as high; availability impact as none.