Vault Root Namespace Operator May Elevate Token Privileges_CVE-2025-5999

7.2 / 10

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy. Fixed in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11 and 1.16.22.

Basic Information

ID CVE-2025-5999

Source HashiCorp

Published Aug 1, 2025 at 17:38

Modified Aug 1, 2025 at 18:08

Affected Product

Vendor HashiCorp

Product Vault

Version 0.10.4

Affected Versions HashiCorp Vault 0.10.4
HashiCorp Vault Enterprise 0.10.4

CWE Classification

CWE-266

References

discuss.hashicorp.com /t/hcsec-2025-13-vault-root-namespace-operator-may-elevate-token-privileges/76032

{
    "lastseen": "",
    "description": "A privileged Vault operator with write permissions to the root namespace\u2019s identity endpoint could escalate their own or another user\u2019s token privileges to Vault\u2019s root policy. Fixed in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11 and 1.16.22.",
    "published": "2025-08-01T17:38:58.409Z",
    "modified": "2025-08-01T18:08:59.605Z",
    "type": "cve",
    "title": "Vault Root Namespace Operator May Elevate Token Privileges",
    "source": "HashiCorp",
    "references": "https://discuss.hashicorp.com/t/hcsec-2025-13-vault-root-namespace-operator-may-elevate-token-privileges/76032",
    "id": "CVE-2025-5999",
    "bulletinFamily": "",
    "cwe": [
        "CWE-266"
    ],
    "cvelist": null,
    "sourceData": "HashiCorp Vault 0.10.4\nHashiCorp Vault Enterprise 0.10.4",
    "sourceHref": "",
    "cvss": {
        "score": 7.2,
        "severity": "HIGH",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Vault",
    "version": "0.10.4",
    "vendor": "HashiCorp",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}