CVE-2025-4166

Published: May 2, 2025Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.

Affected (6)

Products: Hashicorp: Vault · Openbao: Openbao

1 product

1 product

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Hashicorp Vault	From 0.3.0 to 1.19.3
Hashicorp Vault	From 0.3.0 to 1.16.20
Hashicorp Vault	From 1.17.0 to 1.17.16
Hashicorp Vault	From 1.18.0 to 1.18.9
Hashicorp Vault	From 1.19.0 to 1.19.3

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Openbao Openbao	Before 2.2.2

Related CWEs

CWE-209

Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.

References (1)

https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin

Source: security@hashicorp.com

Vendor Advisory

Timeline

No history available yet.