Vigie VulnDBEuropean-hosted Vulnerability DB

CVE-2025-13357

Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method

At a glance

Severity
HIGH 7.4
EPSS
EPSS 0.53 % · percentile 45 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
HashiCorp
NVD status
Analyzed

Description

Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. This vulnerability, CVE-2025-13357, is fixed in Vault Terraform Provider v5.5.0.

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NHashiCorp
CVSS 3.1HIGH 7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NNVD · security@hashicorp.com (Secondary)
CVSS 3.1CRITICAL 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD · nvd@nist.gov (Primary)

Weaknesses (CWE)

Advisories

European references

Affected configurations (NVD CPE)

Affected products

ProductVersions
HashiCorp · Toolingaffected 4.2.0 < 5.5.0

References

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD