CVE-2025-11621: HashiCorp Vault AWS Auth Method Authentication Bypass Vulnerability
Summary
CVE-2025-11621: HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass in github.com/hashicorp/vault. Affects github.com/hashicorp/vault versions >= 0.6.0, < 1.21.0. Fixed in 1.21.0. How to fix ↓
Also tracked for
- vault · Bitnami
The same CVE-2025-11621 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Vault is an open-source tool designed for securely accessing secrets, managing sensitive data, and providing identity and access management. It offers various authentication methods, including AWS Auth, which allows users to authenticate using AWS credentials. This vulnerability specifically affects the AWS Auth method, potentially allowing unauthorized access to sensitive resources.
Vulnerability Detail
The vulnerability in HashiCorp Vault's AWS Auth method may allow an attacker to bypass authentication mechanisms. This issue arises from improper validation of AWS credentials, which could lead to unauthorized access to the Vault. If exploited, this vulnerability could result in sensitive data exposure, unauthorized actions within the Vault, and compromise of the overall security posture of applications relying on Vault for secret management.
How To Fix
Latest published version: v1.21.4 as of 23 Oct 2026
go get github.com/hashicorp/vault@v1.21.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.21.0
This is the first release that contains the fix.
go get github.com/hashicorp/vault@v1.21.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional security measures such as restricting access to the Vault instance, using network policies, or enabling multi-factor authentication for users accessing the AWS Auth method until the package can be updated.
Conclusion
The CVE-2025-11621 vulnerability in HashiCorp Vault's AWS Auth method poses a significant risk of authentication bypass. It is crucial for users to update to the patched version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for github.com/hashicorp/vault →
FAQ
CVE-2025-11621 is a vulnerability in HashiCorp Vault's AWS Auth method that may allow for authentication bypass, potentially leading to unauthorized access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized access to sensitive data and actions within the Vault, compromising the security of applications relying on it.
Yes, a patch is available in version 1.21.0 of HashiCorp Vault. It is recommended to update to this version or later.
If immediate updating is not possible, consider implementing additional security measures such as restricting access and enabling multi-factor authentication.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/vault.
