Vault May Include Sensitive Data in Error Logs When Using the KV v2 Plugin

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2025-4166 · CVE overview and exploitation status

EUVD-2025-13240

GHSA-gcqf-f89c-68hv

BIT-openbao-2025-4166

BIT-vault-2025-4166

GO-2025-3663

cve-program · CVE-2025-4166

• https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin

euvd · EUVD-2025-13240

• https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin

nvd · CVE-2025-4166

• https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin

osv · GHSA-gcqf-f89c-68hv

• https://nvd.nist.gov/vuln/detail/CVE-2025-4166
• https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin
• https://github.com/hashicorp/vault
• https://pkg.go.dev/vuln/GO-2025-3663

osv · GO-2025-3663

• https://github.com/advisories/GHSA-gcqf-f89c-68hv
• https://nvd.nist.gov/vuln/detail/CVE-2025-4166
• https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin

No related changes are available here.