CVE-2025-13357: Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method
Vault’s Terraform Provider incorrectly set the default denynullbind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. This vulnerability, CVE-2025-13357, is fixed in Vault Terraform Provider v5.5.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13357?
CVE-2025-13357 is considered a high severity vulnerability due to its potential to lead to insecure LDAP configurations.
How do I fix CVE-2025-13357?
To fix CVE-2025-13357, ensure that the deny_null_bind parameter is explicitly set to true in your Vault's LDAP auth method configuration.
What software is affected by CVE-2025-13357?
CVE-2025-13357 affects the HashiCorp Vault Terraform Provider versions up to and including 5.4.9.
What potential risks are associated with CVE-2025-13357?
The main risk associated with CVE-2025-13357 is unauthorized access due to possible anonymous or unauthenticated binds being allowed.
When was CVE-2025-13357 disclosed?
CVE-2025-13357 was disclosed in 2025, highlighting a critical misconfiguration issue in the Vault Terraform Provider.