CVE-2025-11621: Vault AWS auth method bypass due to AWS client cache
Vault and Vault Enterprise's ("Vault") AWS Auth method may be susceptible to authentication bypass if the role of the configured boundprincipaliam is the same across AWS accounts, or uses a wildcard. This vulnerability is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27.
Other sources
Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured boundprincipaliam is the same across AWS accounts, or uses a wildcard. This vulnerability, CVE-2025-11621, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11621?
CVE-2025-11621 is considered a critical vulnerability due to the potential for authentication bypass.
How do I fix CVE-2025-11621?
To mitigate CVE-2025-11621, upgrade to Vault Community Edition 1.21.0 or later, or Vault Enterprise version outside of the affected range.
Who is affected by CVE-2025-11621?
CVE-2025-11621 affects users of HashiCorp Vault Community Edition before 1.21.0 and certain versions of Vault Enterprise.
What impact does CVE-2025-11621 have on user data?
CVE-2025-11621 may allow unauthorized access to secrets due to authentication bypass, compromising data security.
Can CVE-2025-11621 be exploited remotely?
Yes, CVE-2025-11621 can potentially be exploited remotely if an attacker has the right conditions set in AWS accounts.