GHSA-mr4h-qf9j-f665

ghsaUSosv

Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration

view advisory published 2025-08-01Licence: CC-BY-4.0

A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-6000US	—	0.95% (61st)	—	2025-08-01
A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’…

references

External citations — patches, advisories, analysis.

https://discuss.hashicorp.com/t/hcsec-2025-14-privileged-vault-operator-may-execute-code-on-the-underlying-host/76033WEB
https://github.com/hashicorp/vaultPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2025-6000ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan