GitHub Advisoryadvisory · Go

GHSA-gcqf-f89c-68hv Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information

MEDIUM Published 2025-05-02 Modified 2025-05-06 Official page ↗
Aliases
CVE-2025-4166
Ecosystem
Go
Packages
github.com/hashicorp/vault
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-209
Reviewed
2025-05-02

Affected packages

• Go github.com/hashicorp/vault: >= 0.3.0, < 1.19.3 → fixed in 1.19.3

Description

Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.

Related

Alias · CVE (1)

  • CVE-2025-4166 Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit… vulnerability

Weakness · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References