Hashicorp Terraform Provider vulnerabilities

2 CVEs affecting Hashicorp Terraform Provider, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-13357, published 2025-11-21.

More from Hashicorp.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-30476, published 2021-04-22. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. HashiCorp Terraform’s Vault Provider (terraform-provider-vault) did not correctly configure GCE-type bound labels for Vault’s GCP auth method. Fixed in 2.19.1.
• CVE-2025-13357, published 2025-11-21. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying…