Vault CVE-2025-3879

Vault and Vault Enterprise (“Vault”) may expose sensitive information when enabling an audit device which specifies the

Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when con

The official vault docker images before 0.11.6 contain a blank password for a root user. Rated critical severity (CVSS 9

HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly gener

An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. Rated critical severity (CVSS 9.1), this

HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthent

HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing neste

Token leakage in HashiCorp Vault and Vault Enterprise (0.11.2 up to 2.0.0, 1.21.5, 1.20.10, and 1.19.16) occurs when an

Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. Rated high severity

HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vuln

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vuln

HashiCorp Vault's KVv2 secrets engine allows authenticated users with glob-based policy access to delete secrets outside