PT-2025-47785 · Hashicorp · Vault Terraform Provider

Published 2025-11-21 · Updated 2025-12-15 · CVE-2025-13357

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vault Terraform Provider versions prior to 5.5.0

Description The Vault Terraform Provider was configured with an insecure default setting for the LDAP auth method. Specifically, the deny null bind parameter defaulted to false, which could allow authentication bypass if the LDAP server permitted anonymous or unauthenticated binds. This could potentially lead to unauthorized access.

Recommendations Update to Vault Terraform Provider version 5.5.0 or later.

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2025-13357

GHSA-GMM6-J2G5-R52M

GO-2025-4152

SUSE-SU-2025:4395-1

Affected Products

Vault Terraform Provider

References · 55

• https://discuss.hashicorp.com/t/hcsec-2025-33-vault-terraform-provider-applied-incorrect-defaults-for-ldap-auth-method/76822 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-13357 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4395-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gmm6-j2g5-r52m · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4152 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13357 · Security Note
• https://github.com/hashicorp/terraform-provider-vault/pull/2622 · Note
• https://github.com/hashicorp/terraform-provider-vault/releases/tag/v5.5.0 · Note
• https://github.com/hashicorp/terraform-provider-vault · Note
• https://github.com/hashicorp/terraform-provider-vault/commit/882bc7f409acc99c872c345edd65159d9568589a · Note
• https://twitter.com/Karma_X_Inc/status/1993359245467676971 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1p5s47k/resumen_diario_de_vulnerabilidades_24112025 · Reddit Post
• https://suse.com/security/cve/CVE-2025-65105 · Note
• https://suse.com/security/cve/CVE-2025-65111 · Note
• https://suse.com/security/cve/CVE-2025-13870 · Note