Vault May Include Sensitive Data in Error Logs When Using the KV v2 Plugin
cve-program · CVE-2025-4166
PublishedVault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.
Read the publisher's advisoryeuvd · EUVD-2025-13240
PublishedVault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.
Read the publisher's advisorynvd · CVE-2025-4166
PublishedVault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.
Read the publisher's advisoryosv · GHSA-gcqf-f89c-68hv
PublishedVault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.
Read the publisher's advisoryosv · GO-2025-3663
PublishedHashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information in github.com/hashicorp/vault
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2025-4166 · CVE overview and exploitation status
cve-program · CVE-2025-4166
euvd · EUVD-2025-13240
nvd · CVE-2025-4166
osv · GHSA-gcqf-f89c-68hv
- https://nvd.nist.gov/vuln/detail/CVE-2025-4166
- https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin
- https://github.com/hashicorp/vault
- https://pkg.go.dev/vuln/GO-2025-3663
osv · GO-2025-3663
Related changes
Linked by CVE identifierNo related changes are available here.