CVE-2025-4166

Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.

CVSS v3 4.5 MEDIUM

4.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:hashicorp:vault:::::enterprise:::*
	cpe:2.3:a:hashicorp:vault:::::-:::*
	cpe:2.3:a:hashicorp:vault:::::enterprise:::*
	cpe:2.3:a:hashicorp:vault:::::enterprise:::*
	cpe:2.3:a:hashicorp:vault:::::enterprise:::*

History

12 Aug 2025, 01:44

Type	Values Removed	Values Added
References	~~() https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin -~~	() https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin - Vendor Advisory
CPE		cpe:2.3:a:hashicorp:vault:::::-:::* cpe:2.3:a:hashicorp:vault:::::enterprise:::*
First Time		Hashicorp vault Hashicorp

05 May 2025, 20:54

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-02 15:15

Updated : 2025-08-12 01:44

NVD link : CVE-2025-4166

Mitre link : CVE-2025-4166

CVE.ORG link : CVE-2025-4166

JSON object : View

Products Affected

hashicorp

vault

CWE

CWE-209

Generation of Error Message Containing Sensitive Information

{"id": "CVE-2025-4166", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@hashicorp.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2025-05-02T15:15:50.313", "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin", "tags": ["Vendor Advisory"], "source": "security@hashicorp.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@hashicorp.com", "description": [{"lang": "en", "value": "CWE-209"}]}], "descriptions": [{"lang": "en", "value": "Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20."}, {"lang": "es", "value": "El complemento Clave/Valor (kv) versi\u00f3n 2 de Vault Community y Vault Enterprise podr\u00eda exponer involuntariamente informaci\u00f3n confidencial en los registros del servidor y de auditor\u00eda cuando los usuarios env\u00edan payloads malformadas durante la creaci\u00f3n o actualizaci\u00f3n de secretos mediante la API REST de Vault. Esta vulnerabilidad, identificada como CVE-2025-4166, est\u00e1 corregida en Vault Community 1.19.3 y Vault Enterprise 1.19.3, 1.18.9, 1.17.16 y 1.16.20."}], "lastModified": "2025-08-12T01:44:28.067", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "D5725166-DE38-4732-943E-593516467228", "versionEndExcluding": "1.16.20", "versionStartIncluding": "0.3.0"}, {"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "03C206B1-F9D1-4C88-AD39-A7D00BA9A14E", "versionEndExcluding": "1.19.3", "versionStartIncluding": "0.3.0"}, {"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "970B0477-CEE0-4A5B-957A-443FC008E9A5", "versionEndExcluding": "1.17.16", "versionStartIncluding": "1.17.0"}, {"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "35573CFA-209A-4C06-ABFE-872F52CAD8F9", "versionEndExcluding": "1.18.9", "versionStartIncluding": "1.18.0"}, {"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "A2697ADE-3ADA-49EC-AA4C-68AE84F56C8D", "versionEndExcluding": "1.19.3", "versionStartIncluding": "1.19.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@hashicorp.com"}