CVE-2025-5999Vault root privilege escalation via policy-name normalization
What broke
Vault treated two policy names as different in the UI and as the same after normalization. A token with a look-alike policy could inherit root. CVSS 7.2. Fixed in the VaultFault train (1.20.2 and matching Enterprise).
Why it matters
Policy-name tricks are the secrets-manager version of Unicode SPNs (KerberLoss). Humans read one string. The ACL engine reads another.
What to do
- Upgrade. Then list policies for homoglyphs and unexpected aliases.
- Restrict
sys/policywrites. A user who can create a policy name is now in your root-escalation model.
After you patch
A vault compromise is not one credential, it is every credential the vault held or could issue.
- Rotate everything in scope, including secrets the vault issued dynamically during the exposure window, because a lease that was valid then may still be valid now.
- Revoke active leases and tokens, then review the audit device log for reads you cannot attribute to a known workload.
- Rotate the vault's own credentials: unseal or recovery keys, root tokens, and any authentication backend configuration that could be used to re-enter.
- Rotate downstream credentials the vault brokered, cloud roles, database users, and PKI certificates, since the point of the vault is that it can mint them. See secrets rotation and what is secrets management.
Sources
- NVD: CVE-2025-5999
- HCSEC-2025-22
Related identity CVEs
Related on Start with Identity
- CVEHashiCorp Vault LDAP auth username enumeration
Vault's LDAP auth method returned different errors for unknown and known users. Enumeration is how a lockout or MFA-bypass chain starts. Fixed in 1.14.1 and the
- CVEVaultFault, first public HashiCorp Vault RCE
Vault's plugin catalog and audit-log handling combined into remote code execution. Cyata, Black Hat USA 2025. A flaw about nine years old. CVSS 9.1. Fixed in Va
- Comparisonakeyless-vs-hashicorp-vault
Akeyless and HashiCorp Vault both deliver enterprise secrets management, dynamic secrets, and certificate and key services, but they differ on operating model.
- Comparisonaws-secrets-manager-vs-hashicorp-vault
This is the classic build-on-the-cloud versus run-a-platform decision. AWS Secrets Manager is a fully managed service that stores and rotates secrets with deep,
- ComparisonHashiCorp Vault vs AWS Secrets Manager vs Doppler
These three secrets managers sit at different points on the control-versus-convenience spectrum. HashiCorp Vault is a portable platform with the deepest dynamic
- CVEVault certificate-auth impersonation, public key not CN
Vault's cert auth method bound the entity to the validated public key, not the certificate CN. An attacker who can present a different cert with a reused key im