← All advisories

Medium severity5.3NVD Advisory· Published Feb 1, 2021· Updated Jun 17, 2026

CVE-2020-25594

CVE-2020-25594

Description

HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

6

Hashicorp/Vault3 versions
cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*+ 2 more
- cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*range: <1.5.7
- cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*range: <1.5.7
- (no CPE)range: before 1.6.2 & 1.5.7
HashiCorp/Vaultdescription
Hashicorp/Vault Enterprisellm-fuzzy
Range: before 1.6.2 & 1.5.7
osv-coords
pkg:bitnami/vault
Range: < 1.5.7

Patches

Vulnerability mechanics

References

2

discuss.hashicorp.com/t/hcsec-2021-03-vault-api-endpoint-allowed-enumeration-of-secrets-engine-mount-paths-without-authentication/20336nvdVendor Advisory
security.gentoo.org/glsa/202207-01nvdThird Party Advisory

News mentions

0

No linked articles in our index yet.