← Back

Terraform Provider

terraform_provider

Vendor: Hashicorp • 2 CVEs

CVEs (2)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2025-13357
1Hashicorp
1Terraform Provider
Jun 17, 2026
Nov 21, 2025
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anon...Show more
Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. This vulnerability, CVE-2025-13357, is fixed in Vault Terraform Provider v5.5.0.Show less
CVE-2021-30476
1Hashicorp
1Terraform Provider
Jun 17, 2026
Apr 22, 2021
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
HashiCorp Terraform’s Vault Provider (terraform-provider-vault) did not correctly configure GCE-type bound labels for Vault’s GCP auth method. Fixed in 2.19.1.