CVE-2025-3879
Fixed in a distro release EPSS <1%CVSS 6.6
Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.
Products: HashiCorp Vault, HashiCorp Vault Enterprise
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/hashicorp/vault | 1.19.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | vault-1.16 | no fix |
| Chainguard | vault-1.16-compat | 1.16.3-r26 |
| Chainguard | vault-1.17 | no fix |
| Chainguard | vault-1.17-compat | 1.17.6-r18 |
| Chainguard | vault-1.18 | no fix |
| Chainguard | vault-1.18-compat | 1.18.5-r15 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250506T153719-1.1 |