CVE-2025-6000: Arbitrary Remote Code Execution via Plugin Catalog Abuse
A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/hashicorp/vaultto a version that resolves this vulnerability.Fixed in 1.20.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.20.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.19.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.18.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.16.23
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6000?
CVE-2025-6000 is considered a high-severity vulnerability affecting HashiCorp Vault.
How do I fix CVE-2025-6000?
To remediate CVE-2025-6000, upgrade to Vault Community Edition 1.20.1 or Vault Enterprise 1.20.1, 1.19.7, or 1.18.12.
Who is affected by CVE-2025-6000?
CVE-2025-6000 affects privileged Vault operators within the root namespace with write permission to {{sys/audit}}.
What can an attacker do exploiting CVE-2025-6000?
An attacker exploiting CVE-2025-6000 may obtain code execution on the underlying host if a plugin directory is configured.
Is there a patch available for CVE-2025-6000?
Yes, patched versions of Vault are available in the release updates for both Community and Enterprise editions.