CVE-2025-11621: Vault AWS Auth Method Bypass Due to Client Cache Vulnerability
Summary
CVE-2025-11621: Vault AWS auth method bypass due to AWS client cache. Affects vault versions >= 0.6.0, < 1.21.0. Fixed in 1.21.0. How to fix ↓
Also tracked for
The same CVE-2025-11621 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Vault is an open-source tool developed by HashiCorp that provides secrets management, identity-based access, and data protection. It is widely used for managing sensitive information such as API keys, passwords, and certificates. The AWS Auth method in Vault allows users to authenticate using AWS IAM roles, providing a seamless integration with AWS services. However, this functionality can be compromised if the bound IAM roles are not configured correctly, leading to potential security risks.
Vulnerability Detail
The vulnerability identified as CVE-2025-11621 in Vault's AWS Auth method arises from the improper handling of the AWS client cache. If the role of the configured bound_principal_iam is the same across multiple AWS accounts or utilizes a wildcard, it may allow unauthorized users to bypass authentication. This can lead to unauthorized access to sensitive data and resources managed by Vault, posing a significant security threat to organizations relying on this authentication method.
How To Fix
Minimum fixed version
1.21.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the same IAM role across multiple AWS accounts or refrain from using wildcards in the bound_principal_iam configuration. This can help mitigate the risk of authentication bypass until the patch is applied.
Conclusion
CVE-2025-11621 represents a significant security risk for users of Vault's AWS Auth method. Properly configuring IAM roles and updating to the latest patched versions are essential steps to safeguard sensitive information managed by Vault. Users are encouraged to implement the recommended fixes and monitor their systems for any signs of unauthorized access.
See every vulnerability recorded for vault →
FAQ
CVE-2025-11621 is a vulnerability in Vault's AWS Auth method that may allow authentication bypass due to improper handling of IAM roles.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability affects all versions of Vault prior to 1.21.0. Users should upgrade to this version or later to mitigate the risk.
If exploited, this vulnerability could allow unauthorized users to gain access to sensitive data and resources managed by Vault, leading to data breaches.
Yes, as a temporary workaround, avoid using the same IAM role across multiple AWS accounts or refrain from using wildcards in the bound_principal_iam configuration.
References
Related vulnerabilities
Recent vulnerabilities recorded for vault.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
