Introduction
Organizations that use HashiCorp Vault for AWS-based secrets management may be exposed to unauthorized access if their authentication configuration uses cross-account IAM role names or wildcards. The flaw can give principals from untrusted AWS accounts Vault access they were never meant to have, which directly threatens the integrity of secrets and credentials in cloud environments.
HashiCorp is a major provider of infrastructure automation and security products. Vault is its flagship secrets management product, widely adopted across industries to manage sensitive credentials and cryptographic material. The AWS Auth method is a core feature that lets AWS workloads authenticate without anyone distributing static credentials.
Technical Information
CVE-2025-11621 affects the AWS Auth method in HashiCorp Vault. The vulnerability arises when the bound_iam_principal_arn parameter is configured with either:
- The same IAM role name across multiple AWS accounts
- A wildcard pattern (e.g.,
arn:aws:iam::*:role/ExampleRoleorarn:aws:iam::123456789012:role/*)
Vault caches AWS authentication responses, and that cache does not adequately tell apart principals from different AWS accounts, or different roles that match the same wildcard. When a principal from one AWS account authenticates successfully, Vault may reuse the resulting cache entry for a principal from another account with the same role name, or for any principal that matches the wildcard. An unauthorized principal can then bypass authentication and obtain a Vault token intended for a different entity.
The root cause is improper cache key construction. The cache keys do not include enough unique identifiers, such as the AWS account ID, to differentiate principals. It is a classic case of CWE-288 (Authentication Bypass Using an Alternate Path or Channel).
No public code snippets or PoC are available for this vulnerability.
Affected Systems and Versions
- HashiCorp Vault Community Edition: All versions before 1.21.0
- HashiCorp Vault Enterprise: All versions before 1.21.0, 1.20.5, 1.19.11, and 1.16.27
- Only configurations that use the AWS Auth method with cross-account role name reuse or wildcards in
bound_iam_principal_arnare vulnerable
Vendor Security History
HashiCorp Vault has had authentication-related vulnerabilities before, including:
- CVE-2020-16250: AWS Auth method authentication bypass via manipulated GetCallerIdentityResponse
- Multiple authentication flaws disclosed and patched in 2025 (see HCSEC-2025-13 through HCSEC-2025-20)
HashiCorp typically responds quickly to security issues, with detailed advisories and backported patches for supported versions.
