CVE-2025-6037— Vault Certificate Auth Method Did Not Validate Common Name For Non-CA Certificates
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-6037
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Vault Certificate Auth Method Did Not Validate Common Name For Non-CA Certificates
Source: NVD (National Vulnerability Database)
Vulnerability Description
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [+trusted certificate+|https://developer.hashicorp.com/vault/api-docs/auth/cert#certificate]. In this configuration, an attacker may be able to craft a malicious certificate that could be used to impersonate another user. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
证书验证不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
HashiCorp Vault Enterprise和HashiCorp Vault Community Edition 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HashiCorp Vault Enterprise和HashiCorp Vault Community Edition都是美国HashiCorp公司的产品。HashiCorp Vault Enterprise是一个企业信息归档平台。HashiCorp Vault Community Edition是一款密钥管理工具。 HashiCorp Vault Enterprise和HashiCorp Vault Community Edition存在安全漏洞，该漏洞源于客户端证书验证不足，可能导致用户冒充。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HashiCorp | Vault | 0 ~ 1.20.1 | - | |
| HashiCorp | Vault Enterprise | 0 ~ 1.20.1 | - |
II. Public POCs for CVE-2025-6037
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-6037
请登录查看更多情报信息。
Same Patch Batch · HashiCorp · 2025-08-01 · 7 CVEs total
| CVE-2025-6000 | 9.1 CRITICAL | Arbitrary Remote Code Execution via Plugin Catalog Abuse |
| CVE-2025-5999 | 7.2 HIGH | Vault Root Namespace Operator May Elevate Token Privileges |
| CVE-2025-6014 | 6.5 MEDIUM | Vault TOTP Secrets Engine Code Reuse |
| CVE-2025-6015 | 5.7 MEDIUM | Vault Login MFA Bypass of Rate Limiting and TOTP Code Reuse |
| CVE-2025-6004 | 5.3 MEDIUM | Vault Userpass and LDAP User Lockout Bypass |
| CVE-2025-6011 | 3.7 LOW | Timing Side-Channel in Vault’s Userpass Auth Method |
IV. Related Vulnerabilities
Same product: Vault
- CVE-2026-5807
Vault Vulnerable to Denial-of-Service via Unauthenticated Ro - CVE-2026-4525
Vault Token Leaked to Backends via Authorization: Bearer Pas - CVE-2026-5052
Vault Vulnerable to Server-Side Request Forgery in ACME Chal - CVE-2026-3605
Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial - CVE-2025-12044
Vault Vulnerable to Denial of Service Due to Rate Limit Regr
Same vendor: HashiCorp
- CVE-2026-7776
Boundary Workers Vulnerable to Denial of Service During TLS - CVE-2026-5807
Vault Vulnerable to Denial-of-Service via Unauthenticated Ro - CVE-2026-4525
Vault Token Leaked to Backends via Authorization: Bearer Pas - CVE-2026-5052
Vault Vulnerable to Server-Side Request Forgery in ACME Chal - CVE-2026-3605
Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial
Same weakness: CWE-295
V. Comments for CVE-2025-6037
No comments yet