CVE-2025-11621: Hashicorp Vault

High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days.

Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS accounts, or uses a wildcard. This vulnerability, CVE-2025-11621, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27

Affected products

• Hashicorp Vault: from 0.6.0, before 1.16.27 (fixed in 1.16.27); from 0.6.0, before 1.21.0 (fixed in 1.21.0); from 1.18.0, up to and including 1.18.15; from 1.19.0, before 1.19.11 (fixed in 1.19.11); from 1.20.0, before 1.20.5 (fixed in 1.20.5)

Published 2025-10-23. Last modified 2026-06-17.