Secrets-manager identity CVEs
A secrets manager is an identity provider for machines. Bypass the authenticator and you do not steal one secret. You become every workload that would have checked one out.
How this protocol fails
Cyata's 2025 Black Hat work on CyberArk Conjur and HashiCorp Vault is the chapter heading. Conjur's IAM authenticator could be pointed at an attacker STS, then chained to template RCE. VaultFault delivered the first public Vault RCE plus MFA, lockout, cert-auth, and EntityID failures. 2023 already had LDAP username enumeration on Vault. Identity teams own these boxes even when AppSec files the ticket.
What security people should do
- Upgrade Vault to 1.20.2+ and Conjur OSS to 1.22.1+ / Secrets Manager 13.6.1+. Take the whole advisory train, not one CVE.
- Rotate every secret the manager held if the authenticator was reachable while vulnerable.
- Restrict plugin catalogs and policy-name writes. Those are root on the secrets plane.
- Prefer cert or OIDC for humans. LDAP+MFA on Vault has now failed this test twice.
CVEs in this category
Showing 15 of 15
- CVE-2025-6037medium 6.8Vault certificate-auth impersonation, public key not CNHashiCorp Vault · HashiCorp · 2025-08-06 · Patched
Vault's cert auth method bound the entity to the validated public key, not the certificate CN. An attacker who can present a different cert with a reused key impersonates the entity. CVSS 6.8.
- CVE-2025-6016highVault TOTP login MFA bypassHashiCorp Vault · HashiCorp · 2025-08-06 · Patched
Vault's TOTP login MFA could be bypassed. Companion to the LDAP MFA bypass in the VaultFault set. Confirm the score against NVD; vendor and researcher figures circulated first.
- CVE-2025-6013highVault TOTP and LDAP EntityID reuseHashiCorp Vault · HashiCorp · 2025-08-06 · Patched
Vault reused EntityIDs across TOTP and LDAP in a way that let one identity land on another entity. Part of VaultFault. Confirm CVSS against NVD.
- CVE-2025-6011mediumVault timing side-channel username enumerationHashiCorp Vault · HashiCorp · 2025-08-06 · Patched
A timing side-channel in Vault auth let an attacker tell valid usernames from invalid ones. Companion to CVE-2025-6010. Confirm CVSS against NVD.
- CVE-2025-6010mediumVault username enumerationHashiCorp Vault · HashiCorp · 2025-08-06 · Patched
Vault's auth methods leaked whether a username existed. Useful as the first step of the lockout-bypass brute force in CVE-2025-6004. Confirm CVSS against NVD.
- CVE-2025-6004medium 5.3Vault Userpass and LDAP lockout bypass via username caseHashiCorp Vault · HashiCorp · 2025-08-06 · Patched
Vault treated Userpass and LDAP usernames as case-sensitive for lockout and case-insensitive for login. Case permutation resets the lockout counter and enables mass brute force. CVSS 5.3.
- CVE-2025-6003highVault LDAP MFA enforcement bypassHashiCorp Vault · HashiCorp · 2025-08-06 · Patched
Vault's LDAP auth method could be convinced to skip MFA enforcement. One of the VaultFault MFA-plane bugs. NVD CVSS was not confirmed at the time of the original write-up.
- CVE-2025-6000critical 9.1VaultFault, first public HashiCorp Vault RCEHashiCorp Vault · HashiCorp · 2025-08-06 · Patched
Vault's plugin catalog and audit-log handling combined into remote code execution. Cyata, Black Hat USA 2025. A flaw about nine years old. CVSS 9.1. Fixed in Vault 1.20.2 and the matching Enterprise trains.
- CVE-2025-5999high 7.2Vault root privilege escalation via policy-name normalizationHashiCorp Vault · HashiCorp · 2025-08-06 · Patched
Vault normalized policy names in a way that let a lower-privilege token become root. CVSS 7.2. Part of the August 2025 VaultFault set.
- CVE-2025-49831critical 9.1CyberArk Conjur IAM authenticator bypass via network deviceCyberArk Conjur / Secrets Manager · CyberArk · 2025-07-15 · Patched
A second Conjur IAM-authenticator bypass, this time through a misconfigured network device. CVSS 9.1. Same Cyata chain as CVE-2025-49827.
- CVE-2025-49830high 7.1CyberArk Conjur path traversal and file disclosureCyberArk Conjur / Secrets Manager · CyberArk · 2025-07-15 · Patched
Conjur allowed a path traversal that disclosed files from the host. CVSS 7.1. Useful in the Cyata chain for reading configuration and secrets material after an authenticator bypass.
- CVE-2025-49829medium 6.0CyberArk Conjur missing validations, permission bypassCyberArk Conjur / Secrets Manager · CyberArk · 2025-07-15 · Patched
Conjur skipped validations that should have blocked a resource injection and permission bypass. CVSS 6.0. The lowest score in the Cyata set, and still part of the unauthenticated RCE chain.
- CVE-2025-49828high 8.6CyberArk Conjur RCE via Ruby template injectionCyberArk Conjur / Secrets Manager · CyberArk · 2025-07-15 · Patched
Conjur rendered a template in Ruby without isolating attacker input. CVSS 8.6. In the Cyata chain this is the step after the IAM authenticator bypass: from forged identity to code execution.
- CVE-2025-49827critical 9.1CyberArk Conjur IAM authenticator bypass via malformed regexCyberArk Conjur / Secrets Manager · CyberArk · 2025-07-15 · Patched
Conjur's AWS IAM authenticator could be pointed at an attacker-controlled STS by a malformed regex (CWE-807). CVSS 9.1. One of five Cyata findings, chainable to unauthenticated RCE. Black Hat USA 2025.
- CVE-2023-3462mediumHashiCorp Vault LDAP auth username enumerationHashiCorp Vault · HashiCorp · 2023-08-31 · Patched
Vault's LDAP auth method returned different errors for unknown and known users. Enumeration is how a lockout or MFA-bypass chain starts. Fixed in 1.14.1 and the matching Enterprise trains.