Introduction
Under certain configuration conditions, a privileged Vault operator can achieve host-level code execution. The flaw sits in a core component of secrets management infrastructure, and it directly affects the security of the credentials, certificates, and other sensitive data that HashiCorp Vault manages.
HashiCorp makes infrastructure automation and security products. Vault, its flagship secrets management product, is widely used in enterprise environments to manage sensitive data and cryptographic material. Thousands of organizations run it, so a vulnerability in one of its core components has a wide impact across the technology industry.
Technical information
CVE-2025-6000 comes from how HashiCorp Vault handles audit device configuration when a plugin directory is set in the Vault configuration. A privileged operator in the root namespace with write access to the sys/audit endpoint can manipulate audit device settings to run arbitrary code on the underlying host.
The root cause is improper control of code generation and execution (CWE-94). The attack uses the audit plugin mechanism, which lets Vault load external plugins to extend its audit functionality. When the plugin directory is configured, the operator can use the audit device's configuration options to write or overwrite files in the plugin directory, which leads to execution of attacker-controlled code.
Exploitation requires three conditions:
- The attacker must have privileged operator access in the root namespace
- Write permission to
sys/auditis required - The Vault server must have a plugin directory configured
With all three in place, the attacker can use the audit device configuration to place malicious code in the plugin directory and trigger its execution. That escalates their privileges from Vault administrator to full system access.
Patch information
HashiCorp made three changes in Vault version 1.20.1 and later releases:
-
The
prefixoption in audit devices, which sets a per-line prefix in audit logs, is now disabled by default for any new audit device. This prevents the unauthorized manipulation of audit logs that could lead to code execution. -
Administrators who want the
prefixoption must now explicitly set theAllowAuditLogPrefixingparameter totruein Vault's configuration file. Turning the feature on becomes a deliberate act, which reduces the risk of unintended exploitation. -
Vault no longer allows audit logs to be written to the plugin directory. That removes the ability to create or overwrite files in locations that could be used to execute arbitrary code.
Administrators should review their configurations and apply these updates to protect their systems.
Patch sources:
Affected systems and versions
- HashiCorp Vault Community Edition prior to 1.20.1
- HashiCorp Vault Enterprise prior to 1.20.1, 1.19.7, 1.18.12, and 1.16.23
- Only vulnerable if a plugin directory is configured in Vault's configuration
- Exploitable by privileged operators in the root namespace with write access to
sys/audit
Vendor security history
HashiCorp has generally handled Vault security issues with rapid patch releases and transparent advisories. Recent vulnerabilities include:
- CVE-2024-9180: Privilege escalation via the identity endpoint
- CVE-2025-4656: Denial of service in recovery key cancellation
- CVE-2025-4166: Information disclosure in audit logs
The company runs a mature vulnerability management process, with clear communication channels and regular security updates.
