Platform
go
Component
github.com/hashicorp/vault
Fixed in
1.20.1
1.20.1
1.20.1
CVE-2025-6000 describes a critical code execution vulnerability discovered in HashiCorp Vault. This flaw allows attackers to execute arbitrary code through manipulation of plugin configurations. The vulnerability impacts versions of Vault prior to 1.20.1, and a patch has been released to address the issue. Prompt patching is strongly recommended.
The impact of CVE-2025-6000 is severe. Successful exploitation allows an attacker to execute arbitrary code within the Vault environment, potentially gaining complete control over the system. This could lead to data breaches, unauthorized access to secrets, and complete compromise of the infrastructure relying on Vault for secure storage and management. The ability to execute code via plugin configuration significantly expands the attack surface, as malicious plugins could be crafted or existing plugins exploited to achieve this outcome. This vulnerability shares similarities with other plugin-related vulnerabilities where improper input validation leads to code execution.
CVE-2025-6000 was publicly disclosed on 2025-08-11. The vulnerability's severity is considered high due to the potential for remote code execution. Currently, there are no publicly available proof-of-concept exploits, but the ease of exploitation through plugin configuration suggests a medium probability of exploitation. Monitor security advisories and threat intelligence feeds for any signs of active exploitation.
Exploit Status
EPSS
0.09% (25% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-6000 is to upgrade to HashiCorp Vault version 1.20.1 or later. If immediate upgrading is not feasible, consider implementing strict input validation on plugin configurations to prevent malicious code injection. Review all existing plugins for potential vulnerabilities and disable any plugins that are not absolutely necessary. Implement network segmentation to limit the potential blast radius of a successful attack. After upgrading, verify the fix by attempting to load a known malicious plugin configuration and confirming that it is rejected.
Update Vault to version 1.20.1 or later. If you cannot update immediately, consider restricting write access to {{sys/audit}} to trusted operators. Review the plugin directory configuration and ensure that only plugins from trusted sources are used.Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-6000 is a critical vulnerability in HashiCorp Vault allowing attackers to execute arbitrary code through plugin configuration manipulation. It affects versions before 1.20.1.
If you are running HashiCorp Vault versions prior to 1.20.1, you are potentially affected by this vulnerability. Immediate action is required.
Upgrade to HashiCorp Vault version 1.20.1 or later. Implement strict input validation on plugin configurations as an interim measure.
While no public exploits are currently available, the ease of exploitation suggests a potential for active exploitation. Monitoring is crucial.
Refer to the official HashiCorp security advisory on their website for detailed information and updates regarding CVE-2025-6000.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your go.mod file and we'll tell you instantly if you're affected.