CVE-2025-4166

mediumPriorität · verfolgen · 26EPSS 0.004 · 39. PerzentilDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.45% (39th) EPSS

CVSS 6.5 · medium

Is it mine?

39 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 3.6

v3.14.5mediumAV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.14.5mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:Nsecondary · ENISA EU

v3.14.5mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:Nsecondary · security@hashicorp.comAusnutzbarkeit 0.9 · Auswirkung 3.6

v3.14.5mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:Nsecondary · OSV

v3.16mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-209USCWE-209USCWE-209US

betroffene Produkte (39)

Betroffene Produkte und Versionsbereiche.

Hashicorp Vault <1.16.18 Enterprisealle Versionencert_bundDE
Hashicorp Vault <1.16.20 Enterprisealle Versionencert_bundDE
Hashicorp Vault <1.17.14 Enterprisealle Versionencert_bundDE
Hashicorp Vault <1.17.16 Enterprisealle Versionencert_bundDE
Hashicorp Vault <1.18.7 Enterprisealle Versionencert_bundDE
Hashicorp Vault <1.18.9 Enterprisealle Versionencert_bundDE
Hashicorp Vault <1.19.1 Community Editionalle Versionencert_bundDE
Hashicorp Vault <1.19.1 Enterprisealle Versionencert_bundDE
Hashicorp Vault <1.19.3 Community Editionalle Versionencert_bundDE
Hashicorp Vault <1.19.3 Enterprisealle Versionencert_bundDE
Hashicorp Vault< 1.16.18 Enterprisecert_bundDE
Hashicorp Vault< 1.16.20 Enterprisecert_bundDE
Hashicorp Vault< 1.17.14 Enterprisecert_bundDE
Hashicorp Vault< 1.17.16 Enterprisecert_bundDE
Hashicorp Vault< 1.18.7 Enterprisecert_bundDE
Hashicorp Vault< 1.18.9 Enterprisecert_bundDE
Hashicorp Vault< 1.19.1 Community Editioncert_bundDE
Hashicorp Vault< 1.19.1 Enterprisecert_bundDE
Hashicorp Vault< 1.19.3 Community Editioncert_bundDE
Hashicorp Vault< 1.19.3 Enterprisecert_bundDE

20 von 39 angezeigt

Advisories (5)

Hersteller- und Ökosystem-Meldungen dazu.

WID-SEC-W-2025-0933Hashicorp Vault: Mehrere SchwachstellenDeutsch2025-05-04csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Hashicorp Vault ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um Informationen offenzulegen.
GHSA-gcqf-f89c-68hvHashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information2025-05-02ghsa · osvUS
Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.
BIT-openbao-2025-4166Vault May Include Sensitive Data in Error Logs When Using the KV v2 Plugin2026-07-27vendor · osvUS
Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.
BIT-vault-2025-4166Vault May Include Sensitive Data in Error Logs When Using the KV v2 Plugin2025-05-07vendor · osvUS
Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.
GO-2025-3663Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information in github.com/hashicorp/vault2025-05-06vendor · osvUS
Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information in github.com/hashicorp/vault

auch bekannt als (8)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv cert_bund NVD CVE.org MITRE

veröffentlicht 2025-05-02geändert 2026-06-17

Referenzen (3)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan