Most recent entries from all

bdu:2025-15600

BIT-vault-2025-11621 — Vault AWS auth method bypass due to AWS client cache

Affected: Bitnami: vault

Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS accounts, or uses a wildcard. This vulnerability, CVE-2025-11621, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27

EUVD-2026-271426

fkie_cve-2025-11621

GHSA-9g4h-h484-3578 — HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass

Affected: Go: github.com/hashicorp/vault

Vault and Vault Enterprise's ("Vault") AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS accounts, or uses a wildcard. This vulnerability is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27.

openSUSE-SU-2025:15710-1 — govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media

govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media

RHSA-2025:21976 — Red Hat Security Advisory: RHTAS 1.3.1 - Red Hat Trusted Artifact Signer Release

github.com/hashicorp/vault: Vault AWS auth method bypass due to AWS client cache github.com/hashicorp/vault: Vault Vulnerable to Denial of Service Due to Rate Limit Regression

WID-SEC-W-2025-2396 — Hashicorp Vault: Mehrere Schwachstellen

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Hashicorp Vault ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen.