CVE-2025-6000VaultFault, first public HashiCorp Vault RCE
What broke
HashiCorp Vault could be pushed into remote code execution through plugin-catalog and audit-log abuse. Cyata reported the set in May 2025, IDs were assigned 12 June, and the public write-up (HCSEC-2025-22, "VaultFault") landed on 6 August 2025 at Black Hat USA. This one is the first public Vault RCE. The bug had been in the product for about nine years. CVSS 9.1. Fixed in Vault CE 1.20.2 and Enterprise 1.20.2 / 1.19.8 / 1.18.13 / 1.16.24.
Why it matters
Vault is the identity plane for secrets, cloud IAM, and often SSH and PKI. RCE on Vault is every secret, every dynamic credential, and the root token story you hoped you would never write. Nine years in-tree is also the process lesson: identity infrastructure ages, and "it has always been that way" is not a control.
What to do
- Upgrade to 1.20.2 (or the Enterprise train that includes HCSEC-2025-22) before you do anything else on this list.
- Rotate secrets Vault issued or stored. If the plugin catalog was writable, assume RCE was possible.
- Restrict who can manage plugins. The catalog is not an AppSec curiosity. It is root on the secrets plane.
After you patch
A vault compromise is not one credential, it is every credential the vault held or could issue.
- Rotate everything in scope, including secrets the vault issued dynamically during the exposure window, because a lease that was valid then may still be valid now.
- Revoke active leases and tokens, then review the audit device log for reads you cannot attribute to a known workload.
- Rotate the vault's own credentials: unseal or recovery keys, root tokens, and any authentication backend configuration that could be used to re-enter.
- Rotate downstream credentials the vault brokered, cloud roles, database users, and PKI certificates, since the point of the vault is that it can mint them. See secrets rotation and what is secrets management.
Sources
- NVD: CVE-2025-6000
- HashiCorp HCSEC-2025-22 / Cyata VaultFault, Black Hat USA 2025
Related identity CVEs
Related on Start with Identity
- CVEHashiCorp Vault LDAP auth username enumeration
Vault's LDAP auth method returned different errors for unknown and known users. Enumeration is how a lockout or MFA-bypass chain starts. Fixed in 1.14.1 and the
- Comparisonakeyless-vs-hashicorp-vault
Vault scores 4.4 to Akeyless's 4.3. Vault is the broadest platform if you can run it and accept BUSL under IBM; Akeyless is the managed alternative with a Vault
- Comparisonaws-secrets-manager-vs-hashicorp-vault
AWS Secrets Manager costs 0.40 dollars per secret per month with nothing to run. Vault has dynamic secrets everywhere and no public price, and you have to opera
- ComparisonHashiCorp Vault vs AWS Secrets Manager vs Doppler
Vault vs AWS Secrets Manager vs Doppler in 2026: IBM's dynamic secrets, AWS at $0.40 per secret a month, Doppler at $21 per user. Pricing, sync and who wins.
- CVEVault certificate-auth impersonation, public key not CN
Vault's cert auth method bound the entity to the validated public key, not the certificate CN. An attacker who can present a different cert with a reused key im
- CVEVault login MFA rate-limit bypass and TOTP reuse
Vault's login MFA rate limits could be bypassed and TOTP codes reused, weakening the second factor. Part of the 2025 VaultFault set with the LDAP MFA bypass in