CVE-2025-11621
Fixed in a distro release EPSS <1%CVSS 8.1
Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS accounts, or uses a wildcard. This vulnerability, CVE-2025-11621, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27
Products: HashiCorp Vault, HashiCorp Vault Enterprise
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/hashicorp/vault | 1.21.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | splunk-otel-collector | 0.139.2-r0 |
| Chainguard | splunk-otel-collector-fips | 0.139.2-r0 |
| Chainguard | vault-1.16 | no fix |
| Chainguard | vault-1.17 | no fix |
| Chainguard | vault-1.18 | no fix |
| Chainguard | vault-1.19 | no fix |
| Chainguard | vault-1.20 | no fix |
| Chainguard | vault-fips-1.20 | no fix |
| Wolfi | splunk-otel-collector | 0.139.2-r0 |
| openSUSE:Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |
| openSUSE:Tumbleweed | govulncheck-vulndb | 0.0.20251105T184115-1.1 |