CVE-2025-4166

Published

Last updated

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-4166

CGA ID

CGA-9wqj-9w69-rh49

Severity

Unknown

Summary

Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information

Description

Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.

References

https://images.chainguard.dev/security/CGA-9wqj-9w69-rh49
https://github.com/advisories/GHSA-gcqf-f89c-68hv
https://nvd.nist.gov/vuln/detail/CVE-2025-4166
https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin
https://github.com/hashicorp/vault
https://pkg.go.dev/vuln/GO-2025-3663

Affected packages

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

CVE-2025-4166

Severity

Summary

Description

References

Affected packages

Products

Why Chainguard

Customers

Company

Resources