CVEvulnerability

CVE-2025-4166

6.5 MEDIUM Published 2025-05-02 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-05-02
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-209

Description

Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.

Affected configurations

• hashicorp vault (>= 0.3.0 < 1.16.20) • hashicorp vault (>= 0.3.0 < 1.19.3) • hashicorp vault (>= 1.17.0 < 1.17.16) • hashicorp vault (>= 1.18.0 < 1.18.9) • hashicorp vault (>= 1.19.0 < 1.19.3) • openbao openbao (< 2.2.2)

Related

Weakness · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References