Start with Identity
Subscribe
Identity CVE · Secrets managers

CVE-2025-6000VaultFault, first public HashiCorp Vault RCE

critical · CVSS 9.1
Product: HashiCorp VaultVendor: HashiCorpDisclosed: 2025-08-06Status: PatchedNVD ↗

What broke

HashiCorp Vault could be pushed into remote code execution through plugin-catalog and audit-log abuse. Cyata reported the set in May 2025, IDs were assigned 12 June, and the public write-up (HCSEC-2025-22, "VaultFault") landed on 6 August 2025 at Black Hat USA. This one is the first public Vault RCE. The bug had been in the product for about nine years. CVSS 9.1. Fixed in Vault CE 1.20.2 and Enterprise 1.20.2 / 1.19.8 / 1.18.13 / 1.16.24.

Why it matters

Vault is the identity plane for secrets, cloud IAM, and often SSH and PKI. RCE on Vault is every secret, every dynamic credential, and the root token story you hoped you would never write. Nine years in-tree is also the process lesson: identity infrastructure ages, and "it has always been that way" is not a control.

What to do

  • Upgrade to 1.20.2 (or the Enterprise train that includes HCSEC-2025-22) before you do anything else on this list.
  • Rotate secrets Vault issued or stored. If the plugin catalog was writable, assume RCE was possible.
  • Restrict who can manage plugins. The catalog is not an AppSec curiosity. It is root on the secrets plane.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.