CVE-2025-6000 PUBLISHED

Arbitrary Remote Code Execution via Plugin Catalog Abuse

Assigner: HashiCorp
Reserved: 11.06.2025 Published: 01.08.2025 Updated: 01.08.2025

A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.1

Product Status

Vendor HashiCorp
Product Vault
Versions Default: unaffected
  • affected from 0.8.0 to 1.20.1 (excl.)
Vendor HashiCorp
Product Vault Enterprise
Versions Default: unaffected
  • affected from 0.8.0 to 1.20.1 (excl.)

References

Problem Types

  • CWE-94: Improper Control of Generation of Code (Code Injection) CWE

Impacts

  • CAPEC-549: Local Execution of Code