CVE-2025-6013
Fixed in a distro release EPSS <1%CVSS 6.5
Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault Enterprise 1.20.2, 1.19.8, 1.18.13, and 1.16.24.
Products: HashiCorp Vault, HashiCorp Vault Enterprise
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/hashicorp/vault | 1.20.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | splunk-otel-collector | 0.138.0-r0 |
| Chainguard | splunk-otel-collector-fips | 0.138.0-r1 |
| Chainguard | vault-1.16 | no fix |
| Chainguard | vault-1.17 | 1.17.6-r20 |
| Chainguard | vault-1.17 | 1.17.6-r23 |
| Chainguard | vault-1.18 | no fix |
| Chainguard | vault-1.19 | no fix |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | govulncheck-vulndb | 0.0.20250814T182633-150000.1.98.1 |
| Wolfi | splunk-otel-collector | 0.138.0-r0 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20250814T182633-150000.1.98.1 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250811T192933-1.1 |
| openSUSE Tumbleweed | openbao | 2.3.2-1.1 |