CVE-2025-6010Vault username enumeration
What broke
Vault returned a different error (or timing) for "user does not exist" and "wrong password." That is username enumeration. Fixed in 1.20.2. A sibling timing side-channel is CVE-2025-6011.
Why it matters
Enumeration is how the lockout bypass becomes a targeted brute force instead of a noisy spray. On a human-reachable Vault UI this is worth patching even if the score looks medium.
What to do
- Upgrade. Confirm login errors are identical for unknown and known users.
- Put the UI behind SSO. Do not offer Userpass on the internet.
After you patch
A vault compromise is not one credential, it is every credential the vault held or could issue.
- Rotate everything in scope, including secrets the vault issued dynamically during the exposure window, because a lease that was valid then may still be valid now.
- Revoke active leases and tokens, then review the audit device log for reads you cannot attribute to a known workload.
- Rotate the vault's own credentials: unseal or recovery keys, root tokens, and any authentication backend configuration that could be used to re-enter.
- Rotate downstream credentials the vault brokered, cloud roles, database users, and PKI certificates, since the point of the vault is that it can mint them. See secrets rotation and what is secrets management.
Sources
Related identity CVEs
Related on Start with Identity
- CVEHashiCorp Vault LDAP auth username enumeration
Vault's LDAP auth method returned different errors for unknown and known users. Enumeration is how a lockout or MFA-bypass chain starts. Fixed in 1.14.1 and the
- CVEVaultFault, first public HashiCorp Vault RCE
Vault's plugin catalog and audit-log handling combined into remote code execution. Cyata, Black Hat USA 2025. A flaw about nine years old. CVSS 9.1. Fixed in Va
- Comparisonakeyless-vs-hashicorp-vault
Akeyless and HashiCorp Vault both deliver enterprise secrets management, dynamic secrets, and certificate and key services, but they differ on operating model.
- Comparisonaws-secrets-manager-vs-hashicorp-vault
This is the classic build-on-the-cloud versus run-a-platform decision. AWS Secrets Manager is a fully managed service that stores and rotates secrets with deep,
- ComparisonHashiCorp Vault vs AWS Secrets Manager vs Doppler
These three secrets managers sit at different points on the control-versus-convenience spectrum. HashiCorp Vault is a portable platform with the deepest dynamic
- CVEVault certificate-auth impersonation, public key not CN
Vault's cert auth method bound the entity to the validated public key, not the certificate CN. An attacker who can present a different cert with a reused key im