Critical severityNVD Advisory· Published Aug 1, 2025· Updated Aug 1, 2025
Arbitrary Remote Code Execution via Plugin Catalog Abuse
CVE-2025-6000
Description
A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/hashicorp/vaultGo | >= 0.8.0, < 1.20.1 | 1.20.1 |
Affected products
2- HashiCorp/Vault Enterprisev5Range: 0.8.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3News mentions
0No linked articles in our index yet.