by Kastro
Paper/Archive/CVE-2025-6000

CVE-2025-6000

HashiCorp Vault — Arbitrary Remote Code Execution via Plugin Catalog Abuse

EPSS 0.9%CVSS 9.1
critical.is priorityof 100
40
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 61.2.612 × 2012.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

Affected

ProductAffectedFixed inSource
Vault0.8.0 – < 1.20.11.20.1CNA
Vault Enterprise0.8.0 – < 1.20.11.20.1CNA

Scores by source

HashiCorp (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refdiscuss.hashicorp.com/t/hcsec-2025-14-privileged-vault-operator-may-execute-code-on-the-underlying-host/76033