CVE-2025-13357

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13357", "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "state": "PUBLISHED", "assignerShortName": "HashiCorp", "dateReserved": "2025-11-18T15:38:23.306Z", "datePublished": "2025-11-21T15:02:27.081Z", "dateUpdated": "2026-04-17T17:57:56.094Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "product": "Tooling", "repo": "https://github.com/hashicorp/terraform-provider-vault", "vendor": "HashiCorp", "versions": [{"lessThan": "5.5.0", "status": "affected", "version": "4.2.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "value": "This issue was identified by a third party who reported it to HashiCorp."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Vault\u2019s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. This vulnerability, CVE-2025-13357, is fixed in Vault Terraform Provider v5.5.0.</p><br/>"}], "value": "Vault\u2019s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. This vulnerability, CVE-2025-13357, is fixed in Vault Terraform Provider v5.5.0."}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115: Authentication Bypass"}]}], "metrics": [{"cvssV3_1": {"baseScore": 7.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1188", "description": "CWE-1188: Initialization of a Resource with an Insecure Default", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "shortName": "HashiCorp", "dateUpdated": "2026-04-17T17:57:56.094Z"}, "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2025-33-vault-terraform-provider-applied-incorrect-defaults-for-ldap-auth-method/76822"}], "source": {"advisory": "HCSEC-2025-33", "discovery": "EXTERNAL"}, "title": "Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-21T15:30:52.630287Z", "id": "CVE-2025-13357", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-24T18:00:33.469Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13357", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-21T15:30:52.630287Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-21T15:30:54.628Z"}}], "cna": {"title": "Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method", "source": {"advisory": "HCSEC-2025-33", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "value": "This issue was identified by a third party who reported it to HashiCorp."}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115: Authentication Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/hashicorp/terraform-provider-vault", "vendor": "HashiCorp", "product": "Tooling", "versions": [{"status": "affected", "version": "4.2.0", "lessThan": "5.5.0", "versionType": "semver"}], "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "defaultStatus": "unaffected"}], "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2025-33-vault-terraform-provider-applied-incorrect-defaults-for-ldap-auth-method/76822"}], "descriptions": [{"lang": "en", "value": "Vault\u2019s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. This vulnerability, CVE-2025-13357, is fixed in Vault Terraform Provider v5.5.0.", "supportingMedia": [{"type": "text/html", "value": "<p>Vault\u2019s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. This vulnerability, CVE-2025-13357, is fixed in Vault Terraform Provider v5.5.0.</p><br/>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1188", "description": "CWE-1188: Initialization of a Resource with an Insecure Default"}]}], "providerMetadata": {"orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "shortName": "HashiCorp", "dateUpdated": "2026-04-17T17:57:56.094Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13357", "state": "PUBLISHED", "dateUpdated": "2026-04-17T17:57:56.094Z", "dateReserved": "2025-11-18T15:38:23.306Z", "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "datePublished": "2025-11-21T15:02:27.081Z", "assignerShortName": "HashiCorp"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "product": "Tooling", "repo": "https://github.com/hashicorp/terraform-provider-vault", "vendor": "HashiCorp", "versions": [{"lessThan": "5.5.0", "status": "affected", "version": "4.2.0", "versionType": "semver"}]}], "source": "security@hashicorp.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hashicorp:terraform_provider:*:*:*:*:*:vault:*:*", "matchCriteriaId": "C152B8B1-F10F-4B82-AD90-6893D062EDC7", "versionEndExcluding": "5.5.0", "versionStartIncluding": "4.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vault\u2019s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. This vulnerability, CVE-2025-13357, is fixed in Vault Terraform Provider v5.5.0."}, {"lang": "es", "value": "El proveedor de Terraform de Vault configur\u00f3 incorrectamente el par\u00e1metro predeterminado deny_null_bind para el m\u00e9todo de autenticaci\u00f3n LDAP a falso por defecto, lo que podr\u00eda resultar en una configuraci\u00f3n insegura. Si el servidor LDAP subyacente permit\u00eda enlaces an\u00f3nimos o no autenticados, esto podr\u00eda resultar en una omisi\u00f3n de autenticaci\u00f3n. Esta vulnerabilidad, CVE-2025-13357, est\u00e1 corregida en el proveedor de Terraform de Vault v5.5.0."}], "id": "CVE-2025-13357", "lastModified": "2026-10-08T10:10:00.227", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "security@hashicorp.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13357", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-21T15:30:52.630287Z", "version": "2.0.3"}}]}, "published": "2025-11-21T15:15:51.313", "references": [{"source": "security@hashicorp.com", "tags": ["Vendor Advisory"], "url": "https://discuss.hashicorp.com/t/hcsec-2025-33-vault-terraform-provider-applied-incorrect-defaults-for-ldap-auth-method/76822"}], "sourceIdentifier": "security@hashicorp.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1188"}], "source": "security@hashicorp.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T15:51:30.184210+00:00", "value": {"mitigation_remediation": ["Update the Vault Terraform Provider to at least version 5.5.0, which fixes the default deny_null_bind setting.", "Explicitly set deny_null_bind = true in Terraform modules that enable LDAP authentication to ensure unauthenticated binds are rejected.", "Verify that the underlying LDAP server does not allow anonymous binds and restrict access to only authorized clients."], "summary": {"action": "Immediate Patch", "impact": "Authentication bypass via LDAP anonymous binds"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the HashiCorp Vault Terraform Provider before version 5.5.0. Any deployments using Terraform to provision Vault resources with the LDAP auth method and relying on the default deny_null_bind setting are potentially impacted. The issue was addressed in release 5.5.0 of the provider.", "description_and_impact": "The Vault Terraform Provider was found to incorrectly default the deny_null_bind setting for LDAP authentication to false, enabling LDAP servers that allow anonymous or unauthenticated binds to be used for authentication. This flaw allows attackers who can influence Terraform configuration to obtain authenticated access that was not intended, compromising confidentiality and integrity of the Vault secrets stored by the provider.", "risk_and_exploitability": "The flaw carries a CVSS metric of 7.4, indicating a high severity. The EPSS score is below one percent, suggesting exploitation is currently unlikely but still possible in a determined threat scenario. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have influence over Terraform configurations and the target environment must use an LDAP server that permits anonymous or unauthenticated binds. When both conditions are present, the attacker can bypass authentication controls and gain privileged access."}}}}, "created": "2025-11-24T09:07:49.589891+00:00", "updated": "2026-04-20T16:00:10.653954+00:00", "vendors": ["hashicorp", "hashicorp$PRODUCT$terraform_provider"]}