Start with Identity
Subscribe
Identity CVE · Secrets managers

CVE-2023-3462HashiCorp Vault LDAP auth username enumeration

medium
Product: HashiCorp VaultVendor: HashiCorpDisclosed: 2023-08-31Status: PatchedNVD ↗

What broke

HashiCorp Vault's LDAP auth method leaked whether a username existed. Different error (or timing) for unknown vs known. Fixed in Vault 1.14.1 and the matching Enterprise line. The 2025 VaultFault set (CVE-2025-6010, CVE-2025-6004, CVE-2025-6003) is this control failing again, then chaining into lockout and MFA bypass.

Why it matters

Enumeration on a human-reachable Vault UI is how brute force becomes targeted. 2023's "medium" LDAP leak is the first chapter of 2025's Vault identity story.

What to do

  • You should already be far past 1.14.1. If an old 1.12/1.13 Community box is still up, it is also in the VaultFault blast radius.
  • Prefer cert or OIDC for humans. Do not offer LDAP Userpass on the internet.
  • Confirm login errors are identical for unknown and known users after you upgrade.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.