PT-2025-18795 · Hashicorp+1 · Key/Value (Kv) Version 2 Plugin+3
Published
2025-05-02
·
Updated
2025-08-12
·
CVE-2025-4166
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Vault Community versions prior to 1.19.3
Vault Enterprise versions prior to 1.19.3, 1.18.9, 1.17.16, 1.16.20
Description
The Key/Value (kv) Version 2 plugin in Vault Community and Vault Enterprise may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API.
Recommendations
For Vault Community version prior to 1.19.3, update to version 1.19.3 or later.
For Vault Enterprise version prior to 1.19.3, update to version 1.19.3 or later.
For Vault Enterprise version prior to 1.18.9, update to version 1.18.9 or later.
For Vault Enterprise version prior to 1.17.16, update to version 1.17.16 or later.
For Vault Enterprise version prior to 1.16.20, update to version 1.16.20 or later.
As a temporary workaround, consider restricting access to the Vault REST API to minimize the risk of exploitation.
Fix
Generation of Error Message Containing Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Key/Value (Kv) Version 2 Plugin
Red Os
Vault Community
Vault Enterprise