CVE-2025-6037

Vault Certificate Auth Method Did Not Validate Common Name For Non-CA Certificates

State: Published
Severity: 6.8 Medium
Published: Aug 1, 2025
Updated: Feb 26, 2026
Reserved: Jun 12, 2025

Description

Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [+trusted certificate+|https://developer.hashicorp.com/vault/api-docs/auth/cert#certificate]. In this configuration, an attacker may be able to craft a malicious certificate that could be used to impersonate another user. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H	HashiCorp

Weaknesses

CWE-295 Improper Certificate Validation

Affected Products

Product	Versions
VaultHashiCorp	before 1.20.1Affected
Vault EnterpriseHashiCorp	before 1.20.1Affectedfrom 1.19.7Not affectedfrom 1.18.12Not affectedfrom 1.16.23Not affected

References

https://discuss.hashicorp.com/t/hcsec-2025-18-vault-certificate-auth-method-did-not-validate-common-name-for-non-ca-certificates/76037

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.