CVE-2025-5999

high

Description

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy. Fixed in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11 and 1.16.22.

References

https://thehackernews.com/2025/08/cyberark-and-hashicorp-flaws-enable.html

https://discuss.hashicorp.com/t/hcsec-2025-13-vault-root-namespace-operator-may-elevate-token-privileges/76032

Details

Source: Mitre, NVD

Published: 2025-08-01

Updated: 2025-08-13

Named Vulnerability: Vault FaultNamed Vulnerability: GO-2025-3837Named Vulnerability: GHSA-6h4p-m86h-hhgh

Risk Information

CVSS v2

Base Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.2

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.00509