CVE-2025-6037

Name of the Vulnerable Software and Affected Versions Vault versions prior to 1.20.1 Vault Enterprise versions prior to 1.20.1 Vault Enterprise versions prior to 1.19.7 Vault Enterprise versions prior to 1.18.12 Vault Enterprise versions prior to 1.16.23

Description The TLS certificate auth method in Vault and Vault Enterprise did not correctly validate client certificates when configured with a non-CA certificate as a trusted certificate. This allowed an attacker to potentially craft a malicious certificate to impersonate another user.

Recommendations Update Vault to version 1.20.1 or later. Update Vault Enterprise to version 1.20.1 or later. Update Vault Enterprise to version 1.19.7 or later. Update Vault Enterprise to version 1.18.12 or later. Update Vault Enterprise to version 1.16.23 or later.