VULNERABILITY INTELLIGENCE

CVE-2025-4166

CVSS score4.5 MEDIUM
EPSS probability0.45%
CISA KEVNot currently listed
Published2025-05-02
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

Description

Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.

Weakness classification

  • CWE-209: Generation of Error Message Containing Sensitive Information

Primary references