CVE-2020-25816: Hashicorp Vault

Medium severity, CVSS 6.8. EPSS: 1% chance of exploitation in the next 30 days.

HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. Fixed in 1.4.7 and 1.5.4.

Affected products

• Hashicorp Vault: from 1.0.0, before 1.4.7 (fixed in 1.4.7); from 1.5.0, before 1.5.4 (fixed in 1.5.4)

Published 2020-09-30. Last modified 2026-06-17.