Start with Identity
Subscribe
Identity CVE · Secrets managers

CVE-2025-5999Vault root privilege escalation via policy-name normalization

high · CVSS 7.2
Product: HashiCorp VaultVendor: HashiCorpDisclosed: 2025-08-06Status: PatchedNVD ↗

What broke

Vault treated two policy names as different in the UI and as the same after normalization. A token with a look-alike policy could inherit root. CVSS 7.2. Fixed in the VaultFault train (1.20.2 and matching Enterprise).

Why it matters

Policy-name tricks are the secrets-manager version of Unicode SPNs (KerberLoss). Humans read one string. The ACL engine reads another.

What to do

  • Upgrade. Then list policies for homoglyphs and unexpected aliases.
  • Restrict sys/policy writes. A user who can create a policy name is now in your root-escalation model.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.