Identity CVE · Secrets managers
CVE-2025-6037Vault certificate-auth impersonation, public key not CN
medium · CVSS 6.8
What broke
Vault's TLS-certificate auth method identified the entity by the validated public key rather than the certificate identity (CN / SAN). A different certificate that reused the key authenticated as the original entity. CVSS 6.8. Fixed in 1.20.2.
Why it matters
Cert auth is how a lot of workloads log into Vault. Binding to the key instead of the name is the opposite of what strong certificate mapping taught Active Directory. The same mental model, two products.
What to do
- Upgrade, then rotate cert-auth roles so each entity has a unique key.
- Prefer binding to SAN URI / SPIFFE ID over "any cert with this key."
Sources
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.