CVE-2025-6000: Hashicorp Vault Code Execution Vulnerability via Plugin Configuration
Summary
CVE-2025-6000: Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration. Affects github.com/hashicorp/vault versions >= 0.8.0, < 1.20.1. Fixed in 1.20.1. How to fix ↓
Also tracked for
- vault · Bitnami
The same CVE-2025-6000 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hashicorp Vault is a tool designed for securely accessing secrets, managing sensitive data, and providing a unified interface for secret management. It is widely used in cloud-native applications and DevOps environments for its robust security features. However, a critical vulnerability has been identified that allows a privileged operator to execute arbitrary code on the host system if certain configurations are set.
Vulnerability Detail
The vulnerability arises when a privileged Vault operator with write permissions to the sys/audit endpoint can exploit a misconfigured plugin directory in Vault's configuration. This could lead to unauthorized code execution on the underlying host, posing significant security risks. The vulnerability is classified under CWE-94 (Code Injection) and has a CVSS score of 9.1, indicating its critical severity.
How To Fix
Latest published version: v1.21.4 as of 23 Oct 2026
go get github.com/hashicorp/vault@v1.21.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.20.1
This is the first release that contains the fix.
go get github.com/hashicorp/vault@v1.20.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the sys/audit endpoint and ensure that no plugin directory is set in the Vault configuration. This will help mitigate the risk until the package is updated.
Conclusion
In summary, CVE-2025-6000 is a critical vulnerability in Hashicorp Vault that can lead to code execution on the host system. It is crucial to update to the patched versions to mitigate this risk. Additionally, implementing temporary workarounds can help protect your system until the update is applied.
See every vulnerability recorded for github.com/hashicorp/vault →
FAQ
CVE-2025-6000 is a critical vulnerability in Hashicorp Vault that allows privileged operators to execute arbitrary code on the host system due to misconfigured plugin directories.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability affects all versions of Hashicorp Vault prior to 1.20.1.
If immediate updates are not possible, restrict access to the sys/audit endpoint and avoid setting a plugin directory in the configuration as a temporary measure.
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/vault.
