CVE-2025-6037

Published: Aug 1, 2025Modified: Jun 17, 2026

6.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Exploitability: 0.9 / Impact: 5.9

Source: security@hashicorp.com (Secondary)

Description

Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [+trusted certificate+|https://developer.hashicorp.com/vault/api-docs/auth/cert#certificate]. In this configuration, an attacker may be able to craft a malicious certificate that could be used to impersonate another user. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

Affected (5)

Products: Hashicorp: Vault

Hashicorp

1 product

Vault

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Hashicorp Vault	Before 1.20.1
Hashicorp Vault	Before 1.16.23
Hashicorp Vault	From 1.17.0 to 1.18.12
Hashicorp Vault	From 1.19.0 to 1.19.7
Hashicorp Vault	Version 1.20.0

Related CWEs

CWE-295

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (1)

https://discuss.hashicorp.com/t/hcsec-2025-18-vault-certificate-auth-method-did-not-validate-common-name-for-non-ca-certificates/76037

Source: security@hashicorp.com

Vendor Advisory

Timeline

No history available yet.