CVE-2025-6037: Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as…

PriorityP433medium6.8CVSS 3.1

AVNACLPRHUIRSUCHIHAH

EPSS

0.21%

11.2th percentile

Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [+trusted certificate+|https://developer.hashicorp.com/vault/api-docs/auth/cert#certificate]. In this configuration, an attacker may be able to craft a malicious certificate that could be used to impersonate another user. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
github.com	hashicorp_vault	>= 0 < 1.20.1	1.20.1
hashicorp	vault	< 1.16.23	1.16.23
hashicorp	vault	< 1.20.1	1.20.1
hashicorp	vault	—	—
hashicorp	vault	>= 1.17.0 < 1.18.12	1.18.12
hashicorp	vault	>= 1.19.0 < 1.19.7	1.19.7
hashicorp	vault_enterprise	< 1.20.1	1.20.1

CVSS provenance

nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

vendor_redhat6.8MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.