CVE-2023-3462HashiCorp Vault LDAP auth username enumeration

What broke

HashiCorp Vault's LDAP auth method leaked whether a username existed. Different error (or timing) for unknown vs known. Fixed in Vault 1.14.1 and the matching Enterprise line. The 2025 VaultFault set (CVE-2025-6011, CVE-2025-6004, CVE-2025-6013) is this control failing again, then chaining into lockout and MFA bypass.

Why it matters

Enumeration on a human-reachable Vault UI is how brute force becomes targeted. 2023's "medium" LDAP leak is the first chapter of 2025's Vault identity story.

What to do

• You should already be far past 1.14.1. If an old 1.12/1.13 Community box is still up, it is also in the VaultFault blast radius.
• Prefer cert or OIDC for humans. Do not offer LDAP Userpass on the internet.
• Confirm login errors are identical for unknown and known users after you upgrade.

After you patch

A vault compromise is not one credential, it is every credential the vault held or could issue.

• Rotate everything in scope, including secrets the vault issued dynamically during the exposure window, because a lease that was valid then may still be valid now.
• Revoke active leases and tokens, then review the audit device log for reads you cannot attribute to a known workload.
• Rotate the vault's own credentials: unseal or recovery keys, root tokens, and any authentication backend configuration that could be used to re-enter.
• Rotate downstream credentials the vault brokered, cloud roles, database users, and PKI certificates, since the point of the vault is that it can mint them. See secrets rotation and what is secrets management.

Sources

• NVD: CVE-2023-3462
• HashiCorp Vault 1.14.1 release notes