Introduction
Anyone who escalates privileges in a secrets management platform can reach the credentials and secrets it stores, potentially all of them. Many enterprises run HashiCorp Vault as a core component for access control and secrets management. For them, a privilege escalation flaw in Vault is an operational problem as well as a security one.
HashiCorp is a major maker of infrastructure automation and security tools. Its Vault product manages sensitive credentials, is used across many industries, and has thousands of enterprise deployments. It also plays a central part in modern DevOps and cloud-native architectures. Because Vault is integrated with critical infrastructure and applications, a vulnerability in it can have effects well beyond Vault itself.
Technical Information
CVE-2025-5999 affects the identity endpoint in HashiCorp Vault's root namespace. An operator with write permission on that endpoint can raise their own token, or another user's token, to the root policy. The cause is insufficient control over privilege assignment at the identity endpoint, specifically in the root namespace. A privileged operator can use this to get around the intended policy restrictions and give themselves the highest level of access in Vault.
The vulnerability is classified as CWE-266 (Incorrect Privilege Assignment). To exploit it, the operator must already have write access to the root namespace's identity endpoint. The referenced materials include no public code snippets or detailed exploitation steps. The flaw is in Vault's core identity management functionality, so it is not limited to an enterprise-only feature.
Affected Systems and Versions
- HashiCorp Vault Community Edition: All versions prior to 1.20.0
- HashiCorp Vault Enterprise: All versions prior to 1.20.0, 1.19.6, 1.18.11, and 1.16.22
- Vulnerable configuration: Any instance where an operator has write access to the root namespace's identity endpoint
Vendor Security History
HashiCorp Vault has had earlier privilege escalation and identity-related vulnerabilities, including CVE-2024-9180 and CVE-2025-4166. HashiCorp usually ships patches for several supported versions and runs a mature vulnerability disclosure program. It has responded promptly to privilege escalation issues, publishing fixes and advisories through its official channels.
