CVE-2025-5999

Name of the Vulnerable Software and Affected Versions Vault Community Edition versions prior to 1.20.0 Vault Enterprise versions prior to 1.20.0 Vault Enterprise version 1.19.6 Vault Enterprise version 1.18.11 Vault Enterprise version 1.16.22

Description A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy.

Recommendations Update Vault Community Edition to version 1.20.0 or later. Update Vault Enterprise to version 1.20.0 or later. Update Vault Enterprise to version 1.19.6 or later. Update Vault Enterprise to version 1.18.11 or later. Update Vault Enterprise to version 1.16.22 or later.