CVE-2025-5999: 
HashiCorp Vault vulnerability analysis and mitigation

CVE-2025-5999 is a privilege escalation vulnerability discovered in HashiCorp Vault that affects both Community and Enterprise editions. The vulnerability allows a privileged Vault operator with write permissions to the root namespace's identity endpoint to escalate their own or another user's token privileges to Vault's root policy. The issue was discovered by Yarden Porat of Cyata Security and was disclosed on August 1, 2025. The vulnerability affects Vault Community Edition from 0.10.4 up to 1.19.5 and Vault Enterprise from 0.10.4 up to various versions (HashiCorp Discussion).

The vulnerability stems from incomplete input validation and normalization of policy names in Vault's identity secrets engine. The issue has been assigned a CVSS v3.1 base score of 7.2 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-266 (Incorrect Privilege Assignment) and only affects root namespace entities, not entities in namespaces including administrative namespaces (NVD).

If exploited, this vulnerability allows attackers to elevate token privileges to Vault's root policy, effectively gaining the highest level of access within the system. The impact is particularly significant as it affects the root namespace, though it notably does not affect HCP Vault Dedicated due to its use of administrative namespaces (HashiCorp Discussion).

The vulnerability has been fixed in Vault Community Edition 1.20.0 and Vault Enterprise versions 1.20.0, 1.19.6, 1.18.11, and 1.16.22. Organizations are advised to upgrade to these patched versions. Alternatively, Sentinel EGP policies can be implemented as a workaround. Detection of exploitation is possible by monitoring Vault audit logs for requests containing 'root' inside the 'identity_policies' array (HashiCorp Discussion).

The vulnerability has gained significant attention in the cybersecurity community, particularly as it was discovered alongside other critical vulnerabilities in enterprise secure vaults. Security researchers have highlighted how this vulnerability, when combined with others, demonstrates how authentication, policy enforcement, and plugin execution can be subverted through logic bugs (Hacker News).