CVE-2025-11621 — Vault AWS auth method bypass due to AWS client cache

CVE-2025-11621

Vault AWS auth method bypass due to AWS client cache PUBLISHED

Description (CNA)

Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS accounts, or uses a wildcard. This vulnerability, CVE-2025-11621, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27

Affected (CNA)

Vendor / product	Versions
HashiCorp / Vault	affected 0.6.0 before 1.21.0
HashiCorp / Vault Enterprise	affected 0.6.0 before 1.21.0

CWE

CWE-288

References

https://discuss.hashicorp.com/t/hcsec-2025-30-vault-aws-auth-method-authentication-bypass-through-mishandling-of-cache-entries/76709

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.