Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2025-6000
9.1
CRITICALCVSS v3
Severity scale
010
Description
A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
hashicorp/vault
GitHubA tool for secrets management, encryption as a service, and privileged access management
GitHubA tool for secrets management, encryption as a service, and privileged access management>= 0.8.0, < 1.16.23, >= 0.8.0, < 1.20.1, >= 1.17.0, < 1.18.12, >= 1.19.0, < 1.19.7, = 1.20.0NVD
hashicorp/vault
Docker HubOfficial vault docker images
Docker HubOfficial vault docker images>= 0.8.0, < 1.16.23, >= 0.8.0, < 1.20.1, >= 1.17.0, < 1.18.12, >= 1.19.0, < 1.19.7, = 1.20.0NVD