CVE-2025-11621

29

FAUCET Score

CVE-2025-11621 is a high-severity authentication bypass vulnerability affecting HashiCorp Vault and Vault Enterprise's AWS Auth method. It arises when the configured bound_principal_iam role is identical across AWS accounts or utilizes a wildcard, potentially allowing unauthorized access. With a CVSS score of 8.1 (HIGH), this vulnerability has a low attack complexity and requires low privileges, but can lead to high confidentiality and integrity impacts. While no active exploitation, public exploit code, or significant community discussion has been observed, immediate patching is recommended to Vault Community Edition 1.21.0 or Vault Enterprise versions 1.21.0, 1.20.5, 1.19.11, and 1.16.27.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 0.6.0, < 1.16.27CPE matchmatch criteria	cpe:2.3:a:hashicorp:vault:::::enterprise:::*
		>= 0.6.0, < 1.21.0CPE matchmatch criteria	cpe:2.3:a:hashicorp:vault:::::-:::*
		>= 1.18.0, <= 1.18.15CPE matchmatch criteria	cpe:2.3:a:hashicorp:vault:::::enterprise:::*
		>= 1.19.0, < 1.19.11CPE matchmatch criteria	cpe:2.3:a:hashicorp:vault:::::enterprise:::*
		>= 1.20.0, < 1.20.5CPE matchmatch criteria	cpe:2.3:a:hashicorp:vault:::::enterprise:::*

CVSS Data

CVSS version used by this source: 3.1

8.1HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

Exploitability Score

2.8

Impact Score

5.2

CvssVersion

3.1

Exploit Intelligence

EPSS Score

0.49%

Probability of exploitation in next 30 days

EPSS Percentile

39.2%

Percentile rank of EPSS score among Peer Group

As of 2026-07-28

Model: v2026.06.15

This CVE's current EPSS score of 0.0049 is in the 28th percentile among its peer group of 17,844 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (24)

gopatch availablevia ghsa

Product: github.com/hashicorp/vaultFixed in: 1.21.0

redhatpatch availablevia redhat_api

Product: Red Hat Trusted Artifact Signer 1.3Fixed in: rhtas/rekor-cli-rhel9:sha256:3782ef36eac0a40b3b8d018476d0af7505d2a81f0ccb993644e8c5f20f1cd566

redhatpatch availablevia redhat_api

Product: Red Hat Trusted Artifact Signer 1.3Fixed in: rhtas/rekor-server-rhel9:sha256:799b0b86f83f0fdf450ecbd2726419570b15f6ec5ba5b814750d45b8269e4dac

redhatpatch availablevia redhat_api

Product: Red Hat Trusted Artifact Signer 1.3Fixed in: rhtas/timestamp-authority-rhel9:sha256:7b3eb9108c50321278ccad2032b3fb365911df83084cca953dd068cdd51f7874

redhatpatch availablevia redhat_api

Product: Red Hat Trusted Artifact Signer 1.3Fixed in: rhtas/client-server-rhel9:sha256:cddda466bc9957f1c3902da3a0cf37ef3ec08f4aeb8c50a421405540120b75cf

redhatpatch availablevia redhat_api

Product: Red Hat Trusted Artifact Signer 1.3Fixed in: rhtas/cosign-rhel9:sha256:a6f3dba2c7ec8cdf7a87a2e8679da66c2248b44c7e15611205f096a6c1629f88

redhatpatch availablevia redhat_api

Product: Red Hat Trusted Artifact Signer 1.3Fixed in: rhtas/gitsign-rhel9:sha256:882d508ec7d71fb3e13ee240ee295ee91884700d63029bb58bd456b6d23fd5e0

redhatpatch availablevia redhat_api

Product: Red Hat Trusted Artifact Signer 1.3Fixed in: rhtas/fulcio-rhel9:sha256:b19900ebbf9cac67196127a60ea2434a8ce2011b17bab15a0e7fc96cf38a63fa

redhatpatch availablevia redhat_api

Product: Red Hat Trusted Artifact Signer 1.3Fixed in: rhtas/policy-controller-rhel9:sha256:7172d6a08594cccd155c2f74110cfbafadb812af84bb6b75c8bec1e3c416bd26

redhatno patchvia redhat_api

Product: Red Hat Openshift Data Foundation 4Fixed in: odf4/mcg-cli-rhel9

redhatno patchvia redhat_api

Product: OpenShift PipelinesFixed in: openshift-pipelines-client

redhatno patchvia redhat_api

Product: Red Hat Openshift Data Foundation 4Fixed in: odf4/cephcsi-rhel9

redhatno patchvia redhat_api

Product: Red Hat Openshift Data Foundation 4Fixed in: odf4/rook-ceph-rhel9-operator

redhatno patchvia redhat_api

Product: Red Hat Trusted Artifact SignerFixed in: rhtas/rekor-backfill-redis-rhel9

redhatno patchvia redhat_api

Product: Zero Trust Workload Identity Manager - Tech PreviewFixed in: zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9

redhatno patchvia redhat_api

Product: Red Hat Openshift Data Foundation 4Fixed in: odf4/mcg-rhel9-operator

redhatno patchvia redhat_api

Product: Red Hat Openshift Data Foundation 4Fixed in: odf4/ocs-metrics-exporter-rhel9

redhatno patchvia redhat_api

Product: Red Hat Openshift Data Foundation 4Fixed in: odf4/ocs-rhel9-operator

redhatno patchvia redhat_api

Product: Red Hat Openshift Data Foundation 4Fixed in: odf4/odf-cli-rhel9

redhatno patchvia redhat_api

Product: Red Hat Openshift Data Foundation 4Fixed in: odf4/odf-multicluster-rhel9-operator

redhatno patchvia redhat_api

Product: Red Hat Openshift Data Foundation 4Fixed in: odf4/odf-rhel9-operator

redhatend of lifevia redhat_api

Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/oc-mirror-plugin-rhel9

redhatend of lifevia redhat_api

Product: Zero Trust Workload Identity Manager - Tech PreviewFixed in: zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9

redhatend of lifevia redhat_api

Product: Zero Trust Workload Identity Manager - Tech PreviewFixed in: zero-trust-workload-identity-manager/spiffe-spire-server-rhel9

Vendor Advisories (2)

goGHSA-9g4h-h484-3578high

HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass

redhatCVE-2025-11621Important

github.com/hashicorp/vault: Vault AWS auth method bypass due to AWS client cache

References

discuss.hashicorp.com / t/hcsec-2025-30-vault-aws-auth-method-authentication-bypass-through-mishandling-of-cache-entries/76709

Vendor Advisory