Start with Identity
Subscribe
Identity CVE · Secrets managers

CVE-2025-6000VaultFault, first public HashiCorp Vault RCE

critical · CVSS 9.1
Product: HashiCorp VaultVendor: HashiCorpDisclosed: 2025-08-06Status: PatchedNVD ↗

What broke

HashiCorp Vault could be pushed into remote code execution through plugin-catalog and audit-log abuse. Cyata reported the set in May 2025, IDs were assigned 12 June, and the public write-up (HCSEC-2025-22, "VaultFault") landed on 6 August 2025 at Black Hat USA. This one is the first public Vault RCE. The bug had been in the product for about nine years. CVSS 9.1. Fixed in Vault CE 1.20.2 and Enterprise 1.20.2 / 1.19.8 / 1.18.13 / 1.16.24.

Why it matters

Vault is the identity plane for secrets, cloud IAM, and often SSH and PKI. RCE on Vault is every secret, every dynamic credential, and the root token story you hoped you would never write. Nine years in-tree is also the process lesson: identity infrastructure ages, and "it has always been that way" is not a control.

What to do

  • Upgrade to 1.20.2 (or the Enterprise train that includes HCSEC-2025-22) before you do anything else on this list.
  • Rotate secrets Vault issued or stored. If the plugin catalog was writable, assume RCE was possible.
  • Restrict who can manage plugins. The catalog is not an AppSec curiosity. It is root on the secrets plane.

After you patch

A vault compromise is not one credential, it is every credential the vault held or could issue.

  • Rotate everything in scope, including secrets the vault issued dynamically during the exposure window, because a lease that was valid then may still be valid now.
  • Revoke active leases and tokens, then review the audit device log for reads you cannot attribute to a known workload.
  • Rotate the vault's own credentials: unseal or recovery keys, root tokens, and any authentication backend configuration that could be used to re-enter.
  • Rotate downstream credentials the vault brokered, cloud roles, database users, and PKI certificates, since the point of the vault is that it can mint them. See secrets rotation and what is secrets management.

Sources

Related identity CVEs

Related on Start with Identity

Last reviewed By SWI Community TeamSuggest a correctionHow we research
Know a primary source we should add, or a patch status that has changed? Email community@startwithidentity.com. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.