VULNERABILITY INTELLIGENCE

CVE-2025-13357

CVSS score7.4 HIGH
EPSS probability0.53%
CISA KEVNot currently listed
Published2025-11-21
Last modified2026-10-08
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Description

Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. This vulnerability, CVE-2025-13357, is fixed in Vault Terraform Provider v5.5.0.

Weakness classification

  • security@hashicorp.com: CWE-1188

Primary references