CVE-2025-11621
📋 TL;DR
This vulnerability allows authentication bypass in HashiCorp Vault's AWS Auth method when the bound_principal_iam role is identical across AWS accounts or uses wildcards. Attackers could gain unauthorized access to Vault secrets. Organizations using Vault with AWS Auth method are affected.
💻 Affected Systems
- HashiCorp Vault Community Edition
- HashiCorp Vault Enterprise
📦 What is this software?
Vault by Hashicorp
Vault by Hashicorp
Vault by Hashicorp
Vault by Hashicorp
Vault by Hashicorp
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Vault secrets, allowing attackers to access sensitive credentials, certificates, and encryption keys stored in Vault.
Likely Case
Unauthorized access to specific secrets based on the compromised role's permissions, potentially leading to lateral movement in cloud environments.
If Mitigated
Limited impact if proper network segmentation, least privilege, and monitoring are in place to detect anomalous access patterns.
🎯 Exploit Status
Requires AWS credentials and knowledge of Vault configuration. Exploitation depends on specific misconfigurations in bound_principal_iam settings.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Vault Community Edition 1.21.0, Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27
Vendor Advisory: https://discuss.hashicorp.com/t/hcsec-2025-30-vault-aws-auth-method-authentication-bypass-through-mishandling-of-cache-entries/76709
Restart Required: Yes
Instructions:
1. Backup Vault configuration and data. 2. Download patched version from HashiCorp releases. 3. Stop Vault service. 4. Replace binary with patched version. 5. Restart Vault service. 6. Verify service is running correctly.
🔧 Temporary Workarounds
Remove duplicate bound_principal_iam roles
allEnsure each bound_principal_iam role is unique across AWS accounts and avoid wildcards in role configurations.
vault write auth/aws/role/<role_name> bound_principal_iam=<unique_arn>
Disable AWS Auth method if unused
allTemporarily disable AWS Auth method if not required for operations.
vault auth disable aws
🧯 If You Can't Patch
- Review and modify AWS Auth role configurations to ensure bound_principal_iam values are unique across accounts
- Implement additional authentication factors or network controls for Vault access
🔍 How to Verify
Check if Vulnerable:
Check AWS Auth method configuration: vault read auth/aws/role/<role_name> and verify bound_principal_iam values are not duplicated across accounts or using wildcards.Check Version:
vault versionVerify Fix Applied:
Verify Vault version is patched: vault version, then test AWS authentication with previously vulnerable configurations.📡 Detection & Monitoring
Log Indicators:
- Unusual authentication patterns from AWS principals
- Multiple authentication attempts from different AWS accounts to same role
- Authentication failures followed by successes from same source
Network Indicators:
- Unexpected Vault API calls from AWS metadata service IP ranges
- Authentication requests from unusual geographic locations
SIEM Query:
source="vault" ("auth" AND "aws" AND "success") | stats count by src_ip, user